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1.1 March 


1.1.1 Exposing the "PDF Botnet" - An OSINT Analysis (2023-03-03 20:34) 


[1] 


https: //ragaz.co.za/XSRYdRIH?utm_term=picsart+background+ image++hd 

http: //www. lbt film. com/uploads/files/koxuwegemagobuwidewas . pdf 

https: //teputire.weebly. com/uploads/1/3/0/8/130813428/tixok. pdf 

http: //www. hypnot iseur.com/wp-content /plugins/formcraft /file- 
upload/server/content /files/16210e2f2aed0f--—-favagujegelivos. pdf 

http: //applecentervn. com/uploads/image/files/81922078809. pdf 

https: //villamishkan. com/310renonew/ front /images/files/womosutilonotolil. pdf 
https: //jackinthegymtpe. com/uploads/files/202204101711569256. pdf 

https: //jigupipugefelo.weebly.com/uploads/1/3/4/3 /134387822 /kexowanegakuxiku. pdf 
https: //ulicetwojegomiasta. pl/kcfinder/upload/files/vadanetezukamiludi. pdf 
http: //toys4boysleather.com/userfiles/file/7982175874. pdf 

http: //93564497 , com/userfiles/texanefimewakatovatoz. pdf 

https: //ceb. 1k/assets/js/kcfinder/upload/files/58252873057 . pdf 

http: //glassinter.de/kcfinder/upload/upload/23524790716. pdf 

https: //jaxurevinul.weebly. com/uploads/1/3/4/8/134868463/3£2975c6121556. pdf 
http: //szm. hu/userfiles/file/wenutoxeworudif. pdf 

https: //dojexivosofu.weebly. com/uploads/1/3/4/3/134348646/6486123. pdf 

http: //veraschwemmle,. de/fckdata/file/dugivisoxolel. pdf 

https: //happycondo. leaddeehub. com/userfiles/files/lipefagajetelegusir. pdf 
https: //ninofupefuf.weebly.com/uploads/1/3/1/8/131856131/6e4017 01laa. pdf 
http: //www. auditsi.com/wp-content /plugins/formeraft/file- 
upload/server/content /files/1622914d312f84-—-—-45312087428. pdf 


Dear blog readers, 


I’ve recently stumbled upon a pretty interesting and worth mentioning malicious software and 
botnet spam and malicious software serving campaign that can be best described as a "PDF 
botnet" where the ultimate idea for both propagation and infection is the active utilization of 
PDF files which are exclusively hosted on compromised or on purposely malicious and fraudu- 
lent rogue and bogus infrastructure. 


Sample screenshots include: 


97D459C 1CS6E327B2FC4000315 1B8D59 
46404445919 16C022B3B4556CSSFD4C22 
6768E55400BB 1B2E 16585AcC6CA091AS 
199CFFO6F35S 1657BC92909C 24928428 
ACCDOLI4BAISF75S36F8D48BDCO708E0 
ISID4BOC 13.4785 1EDOOFS36B2AECIFS 
235DASIBOSFFCB845605266664414,43E 
FSD2C4C3832E34293 AF 4E07911757561 
431F394EB3 1E4C4163F 680027 1347D8E 
CIB3142CCS7BA ISEBS10C9ISDBCCSFADI 
[ 2 ] CSASODDCSES 9850F9E 12 1F53F96 13DCF 


3ASCAIEFOEE 9039097 9E IN2ACCIIEBADO 
1F33F74DA31 1FABOEA269FD657028403 
AOTS87CSE7EOICEFIAFACTA4S9ESAA35 
8E815127969943DF 78773 1FA3226930C 
55 13B8A5636095F44FD591S25ECD72BC 
AS29DF34D6 16C 4B0ABB8 1D7.A6 LAB6FD? 
10C54DA,100008DA2E48 11F53C220D762 
3C402B886B6E 4COBD3CC893 126878455 
56D3AD953D8 17869D766AFSF7EL0CASS 
388FBO258DA09D8C9922A,4A8 1BB72 IDE 
B7SAEIAB464594F349837F 1ES3FCIIIA 
D7506730A7858DSB293B9FS4DAFCOES 
A44FE0258F26CSCSBDEFA7E7AC841383 
D751706B295A39AB430D08ABS941F 465 
3D8C2D8ED 1984B4054C 10232197B0043 

[3] 2e08a6181a4iBsess0Do9FC9793F 1872 


A0Schers netsociality .com\upload\files\65133504721, pdf 
AO0Schers.netsociality com upload files\65 126532258, pdf 
A0Schers,.netsociality .com\uploadfiles\65 106538520, pdf 
A0Schers.netsociality com upload files\65097542930, pdf 
A0Schers,.netsociality com upload files\65097038646 pdf 
A0Schers,.netsociality .com\uploadfiles\65095 106769, pdf 
A0Schers.netsociality .com\upload\files\65092 101739, pdf 
A0Schers,.netsociality .com\uploadfiles\65082426098 pdf 
AOSchers netsociality .com\upload\files\6507473 1923, pdf 
AOSchers netsociality .com\uploadfiles\65053346188 pdf 
[ 4 ] A0Schers netsociality .com\upload\files\65045170125, pdf 


\105chers netsociality.com upload \iles}52598 189728.pdF 
\L05chers netsociality.com\upload \iles}52595666760,pdF 
\105chers netsociality.com\upload\files\5259 1074206 pdF 
\L05chers netsociality.com\upload\files\52590686090 pdF 
\105chers netsociality.com \upload\files\52595945044 pdF 
\105chers netsociality.com\upload\files\52575756525 pdF 
\105chers netsociality.com\upload\files\52572433741 pdF 
\L05chers netsociality.com\uploadfiles\52563930763,pdF 
\105chers netsociality.com\uploadfiles\525591 15925 pdF 
\105chers netsociality.com\upload\files\5255833 1505 pdF 
\10Schers netsociality com \uploadfiles\52552985743,pdF 
\L05chers netsociality.com\upload\files\52533736303,pdF 
[ 5 ] \LoSchers netsociality com\uploadfiles\52533208506 pdF 


Sample URLs known to have been involved in the campaign include: 
hxxp:[/][/]ragaz[.]co[.]za[/IXSRYdR1H?utm _term=picsart+background+image++hd 
8 


hxxp:[/][/JwwwJ[.]lbtfilm[.]com[/]uploads[/]files [/]koxuwegemagobuwidewas|. ]pdf 
hxxp:[/][/]teputire[.]weebly[.]com[/]uploads[/]1[/ ]3[/]0[/18[/]130813428[/]tixok[.]pdf 


hxxp:[/][/Jwwwl[.]hypnotiseur[.]com[/]wp-content[/]plu gins[/]formcraft[/]file- 
upload[/]server[/]content[/]files[ /]16210e2f2aed0f—favagujegelivos|[.]pdf 


hxxp:[/][/Japplecentervn[.]com[/]Juploads[/Jimagel[/]fi les[/]81922078809[.]pdf 
hxxp:[/][/]villamishkan[.]com[/]310renonewl[/]front[/] images[/]files[/]Jwomosutilonotolil[.]pdf 
hxxp:[/][/Jjackinthegymtpe[.]com[/Juploads[/]files[/] 202204101711569256[. ]pdf 

ne eS UnIE eieren sce ye one nPa aaa 1[/]3[/]4[/]3[/]134387822[/]kexowanegakuxiku[. 


hxxp:[/][/Julicetwojegomiasta[. ]pl[/]kcfinder[/Jupload[ /]files[/]vadanetezukamiludi[.]pdf 
hxxp:[/][/]toys4boysleather[.]com[/Juserfiles[/]file[/ ]7982175874[. ]pdf 
hxxp:[/][/]93564497[.]com[/Juserfiles[/]texanefimewakat ovatoz[.]pdf 
hxxp:[/]L[/Iceb[.]Ik[/Jassets[/]js[/]kcfinder[/]up load[/]files[/]58252873057[.]pdf 
hxxp:[/][/]glassinter[.]de[/]kcfinder[/Jupload[/Juplo ad[/]23524790716[.]pdf 
hxxp:[/][/]jaxurevinul[.]weebly[.]com[/Juploads[/]1[ /13[/]4[/]8[/]134868463[/]3f2975c6121556[.]pdf 
hxxp:[/][/]szm[.]hu[/Juserfiles[/]file[/]wenutoxew orudif[.]pdf 
hxxp:[/]L[/]dojexivosofu[.]weebly[.]Jcom[/Juploads[/]1 [/]3[/]41[/13[/]134348646[/]6486123[. ]pdf 
hxxp:[/][/]Jveraschwemmle[.]de[/]fckdata[/]file[/]dugi visoxolel[.]pdf 
hxxp:[/][/Jhappycondo[.]leaddeehub[.]com[/]userfiles[/ ]files[/Jlipefagajetelegusir[. ]pdf 


hxxp:[/][/Jninofupefuf[.]weebly[.]com[/]uploads[/]1[ /)3(/]10/18[/113- 
1856131[/]6e401701aa[. ]pdf 

hxxp:[/][/Jwwwl. Jauditsi[.]com[/]wp-content[/]plugins [/]formcraft[/]file- 
upload[/]server[/]content[/Jfiles[/] 1622914d312f84—45312087428[. pdf 
hxxp:[/][/Jwwwl[.]christinemartin[.]co[.]uk[/]wp-conte nt[/]plugins[/]formcraft[/]file- 


upload[/]server[/]content[ /]files[/]1621dac28b28a0—tufupavokuj[. ]pdf 
hxxp:[/][/]Jsendediangi[.]Jcom[/]Jupload _fck[/]file[/]2022-3-21[/]20220321161426543141[. ]pdf 


hxxp:[/][/Jerdelyironkbutor[.]hu[/Jadmin[/]kcfinde r[/Jupload[/]files[/]sukotigipapewefowul[.- 
]pdf 


hxxp:[/][/]Jstudioingegneriavaragnolo[.]com|[/Juserfiles[/] files[/]kilukowap[.]pdf 
hxxp:[/][/]f-kcc[.]jp[/Juser _data[/Juserfiles[/]files[/]22156092393[.]pdf 
hxxp:[/][/Jalkoplast[.]rs[/]files[/]28560168304[.]pdf 
hxxp:[/][/Jarborspringsforestry[.]com[/Jimg[/Ifiles[/] kelagug[.]pdf 
hxxp:[/][/]cissud[.]it[/Juploads[/]ck _editor[/]files[/]33956310758[.]pdf 
hxxp:[/][/]jfd[.]Jnews[/lapp[/]webroot[/Juploads [/]files[/]71167178402[.]pdf 
hxxp:[/][/Jleg-vein[.]jp[/]kcfinder[/Jupload[/Jfiles [/]sevavimelozojufezetowe|[. ]pdf 
hxxp:[/][/]duxotitur[.]weebly[.]com[/Juploads[/]1[/ ]3[/]4[/15[/]134596147[/]5545494[. ]pdf 
hxxp:[/][/]tree-house[. ]jp[/Jassets[/]news[/]files[ /]Jtevasurodajaxajezetatug[.]pdf 


hxxp:[/][/]kikebazelagugez[.]weebly[.]com[/Juploads[/] 1[/]4[/]1[/]2[/]141287616[/]77fd513b304b[.] 
pdf 


Sample MD5s known to have been involved in the campaign include: 
5BB96B309B8CB58071B73118D1A59C05 1278967687.pdf 
6E3EB89CFD46D107905D9F60853E2661 1410845058. pdf 
OCF4455F92A6397521FC9BDO8FC70A12 1487091430. pdf 
20DA43AD4878B9F925F88854574010E2 1983674347.pdf 
8C2E4E0C3EB5E0131324CA54FD1648BE 3480745958. pdf 
23C45840B8F4EEF5F53CD35BC087D299 3552074133.pdf 
9DA1E72A18F214555449BA3F8EBD1399 3964667 732.pdf 
879332C060A637B45E958911B84627B0 4092425255.pdf 
A409086CDEF2B6C412B33EA8B53E70AD 4474449835. pdf 
A4BB4C77DF8328AE46CEED4F373D2C1C 5741836759.pdf 
B2EB74B29686039C6DCAADOB801A125E 6103190089. pdf 
342D15A9D8A9CAC6C482EF24C63FB7FF 6497559623.pdf 
53A8F7A614EAC9833FO0CC5B97AE8650A 8742646775.pdf 
82D26DA61A8A0F389664859B38ECCO8C 8791363493.pdf 
99B141C2A8E5073C17E81E144734A361 8983036096.pdf 
AD4C11FEFBE2A16AE8358BC51A8CBF3F 9120465087.pdf 
C9A7E18ACBF4EE0ED5435B73E1957A9F 9231960459.pdf 
699553341D62FBCOC1EE86266865DE72 9348069038. pdf 
FBFE529A50E15B66DD40829525E7F7BA 9699229203.pdf 
63BB161319E4E3584821D861AB541A0C 10348572906.pdf 
BB568F6CD8AE515EAD55259470298D9E 13416475440. pdf 
16E42D227211DAC5260BD8FD15A795C7 13823887193.pdf 
3C1CE3A5A0B49D5AA198F0279889D493 13847861787.pdf 
66BD8B8E665AC62A0FA67F111256541F 14137532633.pdf 
B16E989493AD266A39A123629EADD229 14318140657.pdf 
01373CA6F7533D66BF5A57390F9FFA31 16011902586.pdf 
5A5AA084699C1415D962E0D59E637815 16634552211.pdf 
511EEB37D73F3A001A9BB2D7640FA699 16906517497.pdf 
9C6FF15B179AB97DCA523A26C1DD94CC 16956540666.pdf 
BCO9DFB24FF84BFAEC4606F78ED13795 19309202684.pdf 
DBD8A6D7FD0898EDODF40243E1AAAAF3 19351352124.pdf 
B4F88922DC09879A1497D90F8C35017D 19470278438.pdf 
CB954B8C3DCF9F2401777255F261175F 19942463577.pdf 
10 


E3682885AD809552467EA6D31B72F161 20762845009. pdf 
94417B7921DEEC6DFDAF998D60092C0A 20935069756. pdf 
3B268B1A3007FE1CC7CF6CODA4BB48D8 21512890984. pdf 
0A50635185BD60EEC67121B6DA3ABA53 23074157543.pdf 
OA30EB2A19FOB8BFB9B88F4EFO5ED6F5 23192983959.pdf 
A475775F774BC3BE647E773651CF7D55 23413321203.pdf 
40EB5082EF96374B980381926703D5F8 23662198111.pdf 
789B95F9DB6CAA4936B34D3CEB67812A 24028260079.pdf 
34089FC75CFDD5C13521F50946F4A60F 24383278820.pdf 
703A35F8A9783257633289A8112CA8EE 24570234767.pdf 
C571B477784EA78362C75E0C80BC52E5 24576678480. pdf 
7A6D9DA541454F316BE5833F540A661A 25012047289.pdf 
5A39F885D230E41E876BD7B4DC127143 25113113235.pdf 
2C5C47C5DFBB402B235669A19D2414A4 25287545664.pdf 
FEB7F4CC1L6OFCD8E44228957DC824B955 26667812882.pdf 
1F85DE9AE45F522406BE8987EDE93181 26938695486. pdf 
B615646E1A0E05D498141C72D9BDB086 27160090611.pdf 
F9216697756024D30A521785B289288A 27572976263.pdf 
56A6A24439331D48A2C9C3B6F570241B 27751569303.pdf 
9114B9659107251815BAE5E370AEE521 29490266026.pdf 
C3694D3870DF87D08C0496CB661154FB 30004381634.pdf 
B38094C9BC65FB6343F59BB3A130CB1D 30592917019.pdf 
7F99C5F6518B108ACFC4A2E467CCOB87 30602802335.pdf 
5428CAFA77027067AB884629F505A5D9 30748908935.pdf 
7E5E2135615554C27453AAD7B1A678EF 31225466521.pdf 
D3F0D24375DB70EBBE8EA038D217DBC7 31938967008.pdf 
6FF9D1781AE714876DD3580411AB7ACF 32254341335.pdf 
84EFCCC1F53EAD66E85A560E96851117 32393228056.pdf 
017731B0A64C89AD93CAB89E7E60F47C 33397258482.pdf 
C48AA44D8A9A4B1ED191B8A5A325E7C7 33987696728.pdf 
9C81B5DD618E8FA2C621E2FC4FFEF794 34128677256.pdf 
56D8DFD5C5998A9AD54EDD6B15870EB1 34270899382.pdf 
FDD52BCD91FFDO5CBAFE2DAD121A5FEF 35034639506. pdf 
CDO05EE764ED3EAEC7D316B236B6CEB4 35532735673.pdf 
E8D1B9F198CD2D0830D2F6C37B687D78 35848063192.pdf 
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B5DBD44CA0DE7A093069635659D61C01 36254620596.pdf 
E29FBC13ECBEC487B2EEA80C93AE8579 36305895679.pdf 
55BF7695FECEA6D10134BB9CO7FD6A31 37175442866.pdf 
OCDBDE8BE4FF5C4073C2F9D6D1E611B1 37846248199.pdf 
15968137306B287CAFDBA85916A1BE5C 38227904768.pdf 
69DC69862D969FAB1E349102DD94ADD6 38670953669.pdf 
803F22AA33B40C2FOBDB6B25A16E3684 39352660770.pdf 
B6CBD98D34ADBA0FAB5A38C52CD01547 39456879426.pdf 
5E80A6D882AAEB86709DD2611A251FF4 39651425770.pdf 
FCEFE58019233EAA6EF5CD83727F40FC 40271792214.pdf 
5B97DD0747E7EE81549BD67137A94F4C 40717989377.pdf 
A6CC2DE5E257989A9F3B8B3661678CFE 40909229408.pdf 
OAAECB80BE4546EB47644529F4990BB7 42235242507.pdf 
5B5CD32AB0AA5645B37E66C08054E894 42791686638.pdf 
1DA9CC9BC1F440797660981673D6A8CO0 42929172044. pdf 
DE011F2246D6C5C760DC64BC9686384A 43555346587.pdf 
132F2F55F8C37ACA2E507662633E55F7 43655782866.pdf 
C4B746D141DD85C3D4E180FB4C321EB7 43693913284.pdf 
4AB5BDD11836160AD1A002F1DBF66344 44524825310.pdf 
4CFOFEF268B949566E99F8F196B75A2A 45453061496. pdf 
7D5301DA81F5D2F71D925FA26D3D6E23 45691664148.pdf 
B3A9971FBB3CCC4AB62EED96C6F65277 45829389524. pdf 
4AFAF3DBF100EFFCC6E586D8A3E61D1E 47577473045.pdf 
FFO04B0A143D072F57C151DE23D1DABD0 49494005888. pdf 
CCF617937AABBF27A14EE440AECEDE6E 49834067643.pdf 
B158D6E868131FBB511215DE1F7C43A5 49907284246. pdf 
A8CC11CB5EC85076B5AF16B26CDFF524 50726467133.pdf 
1EEB9B17F7F13DF4E06A46058D6AD847 51845523569.pdf 
F744246A7B062F565BF2CE4D2EA9CC19 52700027443.pdf 
535A660198A21E5C2FEDA64A904BD4FA 52725579741.pdf 
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40D4A927A0E086431ACA5C2085E64044 xajeseniravudum.pdf 
8EF15BC5EBEB99F30DEA0443FCD6EC44 xaligokubogilegerewit. pdf 
E5C951D7D00F82257848D9B32C2CAB69 xanona.pdf 
8EB3C48DA38BE3A5B6134FB81248D6FA xegozanu. pdf 
7FD6EC1EB5183A0C1F1AD7787BC88866 xegukiguwipemagepamipi.pdf 
3676B2436F5DC22024E0B9120AFB30BD xelaperepef.pdf 
2808A6181A41B5B530D09FC9793F1872 xikupigivemuvu. pdf 
3D8C2D8BD1984B4054C10232197B00A3 xogipopoferixavaferov.pdf 
D751706B295A39AB430D08AB8941F4A5 xolawukixemojakedape. pdf 
A44FE0258F26C5C5BD6F47E7AC841383 xumerozitazefiwil.pdf 
D7506730A7858D5B293B9F54DAFCOE91 zegolorufula. pdf 
B79AE9AB464594F348B37F1E83FC991A zemuzafosodomebonudomuvat. pdf 
388FB0258DA09D8C9922AAAA1BB721D6 zetewafolajepugo. pdf 
56D3AD953D817869D766AF5F7E10CA55 zifefavix.pdf 
3C402B886B6E4COBD8CC89312687B455 zivawore.pdf 
10C54DA100008DA2E4B11F53C220D762 ziwukoxib.pdf 
A629DF34D816C4B0ABB81D7A61A86FD7 zizal.pdf 
5513B8A5636095F4AFD591525ECD72BC zolijorakozone.pdf 
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8E8151279699A3DF787731FA3226930C zomenuduvokag.pdf 


A07587C5E7EO1CBF1AFAC7A469E5AA35 zoreveniwivopopalu. pdf 


1F33F74DA311FABOEA269FD65 7028409 zuludajafikoraketojesafaz. pdf 


3A5C49EFOEE9090979E902ACC936BADO0 zunanegewafo.pdf 


FCCFA12EQAD95A7E5CC62E2355160CF5 267343834.pdf 


EOADAA6C8DE2FA8CBC434A3D0475E8F2 974628066.pdf 


CA9D188A3ED0984F5787535ADACF5EFA 985373609. pdf 


11F9E844F718A30AEC3AD7BB39F984C9 1012580328. pdf 


Stay tuned! 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVvVXsEi0toPrGr1Brmf 18iXXhjXBEJ3NCj cD£W190_ofLIqN9igx4 


DvIOOUCOALrKVGCOo9QgzCh9sNttzmJ6dj y3CEXNG8i81XDHM6hri 
. https://blogger .googleusercontent .com/img/b/R29vVZ2x1/AVvXsEgbk2LS3gt08v jDnxA8BqAxcU17 vJKqmBwYhVYUk JMA36vt6 
6qVOm3n0xB- bbG2eWeWtfFe-vy3KbK1lqmGv jv_9-YMFj_bEvy0QqT- 
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ttps://blogger .googleusercontent .com/img/b/R29VZ2x1/AVVXsEhE9m2b3hRbPk4-4gi UOLLWSHVVUWZ6AMzVdtKrSqzaEEkl1s 
sSButxJU1LQnmLYF6sTeHVN8N4osyKrbWuMuBCxrMpcaVsj5pQRDRB 
ttps://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVvXsEhHJ7 2HrN9kKOEZkHot dUQK2-mYtWLJHRTq7KAKtmhNUBaNh 


66kQ-ROD9ZPSEUWzZ07NbW1iyRSIGTD9nR41IbslguD60DGLXt fHDXcM 


ttps://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEgqdGbbYA j96hb7Z7 JYYFMwqOutDK2jRM_zMGnUpcAG1tYXO 


Z3aVZ3tK37 cTL7 jnOYftoxoH43IqkdytEgFrcE_FvWjf£DT1JS74w0 


> 


sh 


1.1.2 Clustering Phishing Campaign’s Rogue and Fraudulent and Malicious Hosting 
Infrastructure Pointing to Massive IPFS Web 3.0 Hosting Infrastructure Abuse 
- An OSINT Analysis (2023-03-04 19:24) 
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CG 0&8 mm trustwave-ibank.com \ tha WW + = 


RF BCBAAN , AMRER 


Dear blog readers, 


I’ve recently stumbled upon a pretty interesting phishing campaign including the actual hosting 
infrastructure behind the campaign where I’ve decided to share my findings with everyone in 
particular the fact that the campaign including several other which I'll profile in this post are 
currently hosted on Ipfs’s Web 3.0 infrastructure. 


Sample screenshots include: 


[2] 
22 


<7 GS © & Mimwebink.com.au/Dhl/eiipinyrorsion/indes pip a t= 


We could not deliver your package due ta an incorrect delivery address, 
Please confirm your address and pay your shipping cost 
to receive your package. 


105678203 


"Hive action met he competed within 14 say 


CONTACT AND SUPPORT taoar ALERTS. About DHL 
TADS privacy Monee Friwd support: Careers 
Contact Us bewertant jntortnanion Logal notice 
find 9 tacation 
roLowus @ ov ae 8 2022 © Deutsche Post AG » all rights reserved 


[3] 


DHL x + 


Cc O & Mims /webink.com.au brpltey t wv + = 


Marchand: OHL international GmbH 
Amount: 1.99 § 
Card Number } xxxx XxxxK MXR XXX 


confirmation code 


confirm payment 


Sampe URL redirection chain: 


hxxp://trustwave-ibank[.]com/I/LiinkedInhardest/900/ -> hxxp://kit[.]fontawesome[.]com/585b05125- 
1[.]js (b5a82299925ac96a1454732ab97f2bb5) - 104[.]18[.]23[.]52 


Related MD5s known to have been dropping the same identical phishing infrastructure 
javascript obfuscation script include: 


00666c31b9016602ffe0eae49a5e4ee5d4a079ad101c8e70aalcdd2295e3937f 
009710a0792b2f8dda23bee9f79644b3b19d092962d09aec1 9eff04d217d1f94 
01db44f671d5b9e2ed3ca4a7f2e9d58d9887fd28d54d5b1d531el14ba8df47f6be 
03026db9bd10d9d980923a457f2774497a34c96bealebf7cb74f13383af2271¢c 
03763ee4d8e0d5e495fc8966702f3933f8f1547b25804038ab89acab01cb67df 
03c186b5d249f5c9ded786871d5cc99130ce8c24c54bf8151868ee03c2db0ab6a 
04527364ea88ac8a81laf4e4c0dal3221fc31fac2d17ff73e11lecdaa8975b9596 
0497603023cec2168783ec0a9d29e5b9f0d3e40e6b832b205892fcab82bbd0ed 
04ee5db7857c070cde6a99962fd7 1d9d0f4bf5a23a5203605b0f23e10de649d3 
067e21f3b35b0fa5ac87c47b6b87b3f5e8f14928e8028fba92b79a29c404a84d 


086d54913106d49ceced058de30b80732cb57b68b9bflad75e0535fe48a737f8 
24 


099afbc81e7c19775fc09a26d75b10997e36ae0fe23dd078c131a963fce15896 
09cdc9b2be4d497beb6c3392ff2cdc8a2145498a568110c99cb2d285945d8a3c9 
0c5cd0f3718725137d566f1892ff4c3aaa4ef31dcec98ca932f7315306352144 
0d5aa9847cb1cada491651830baf32a7b255464bcal4fc787663a55cdb02e3c6 
Oecld2ca6f2f015f2440cf6b16ec8fab91208b23524d93f77b7734189590abc7 
Ofb5d884ea6cde5c7b4bb5ae590a0971f7cb2ae6e9d110d89b1c57b006d13a81 
11c6248d01c2c52fd93f4e1676ede5afe332b32303db5e4d4b813285c2fc2a25 
11cb76d18eb86a1a55b2d6d0da43c361501a67826b9bf43b7 74a5bfbf3b6a203 
12c6flf85e3a0bae45al3e8fa70c37a35782fd8ed4a05eb35e4704c0a0e09105 
12f06ca666f09b7dda09f399896024e3344fe19d243dacd7eb2698ca9bb94530 
1300a1f6e068d2362b958a53ee4ded3e6ed7b63b04649d3f8a708d8ce5e33ca0 
14922a4bc2884913ab6e57b1965e82181b06cac1b6261c3a16475a4fbd3735ce 
15449d0dc1b76471fc269cdaa37d2e5f10fb812f417d5d271b7aefc63e6ae137 
15ac93c9c5be20926f8b58084d71900c3e846abaf053a54bee19db41a6c709da 
15ff4la7b686de66a8cb47dbf37006966dd81b5148ca352532b605551a0c6a0e 
1806f6e00b38287c20d58104a7d3728223e4171f57f3b36844e178d44995dcOf 
1846902858f655ea58b601568aa80ecbflb54bceba87875dd01dccad75918e36 
1882falbed2a53a486dc07f4eb1858e6b9233402ef0f7b475246102189e8a405 
19915d17f3bb2c2f6cba6d7c8f70fdc1d3793d811d5d6ee21e9253b17fc24cla 
19ecf0308f99a39fcc1124c6b67a486f43b10460e4810eef69089267d69edb09 
1a0b8de3d820d16121d6435726b496bd281b2537e83b2ee8ec5fcceb87f2a623 
1ab79910d98dalafabe2e982392b5c71ba5a28d6396cb5d495 70f0bc06b595d2 
1c7cf6889ff637ed4d2148122235f9b44367d3b1ba4305ae2b2e126ba26147c9 
1d94581a181cd2c1be0d6329936c715a6cd39fb2a09d912de95699c37527ae41 
1dd547317b93f57528fa914cOcf791eeb396736fe8876132680cc39f3dc77d2c 
1e85b60b46b9683a64e466785a5bf429025aa651cf7a84765740eef/deffaf8d 
1eb4424393a6f3846816f47cf68012de2f8407d5b1f9a93f67c1b620f3eab3de 
1lec05ec963b867ad5df3e8deba62ac3d35b5ec8d5064fc541f848a863dedfd6e 
1f9123ec02d098965c87ff2d24ab0b1b6bebflee5be4505896717f5b8762c924 
2022f9b2f554dd627190f25f3873e9bc83ae3a8222f8cbeeb3944cal4c5a78b0 
205c0eac682985f26e8e0a365dbd7341f9b14ca7c43f0c969da861f0163bffdc 
20b9787348f3c6cf47aa38e61125563adc32fa5d849c87f7409b60e23c59f510 
212a8b969ddc4dee979b49c95255fcc6a7ef8C53c61f3298730a69ae724d239b 
215ff84fb3036e712bd0d12f088ee233153f4fb12508100e08230372e33d44f2 
21b748624f3a1e051a500d58ba040da5f8b2ea70a8532b6d088b1a2c07b75ecc 


21e9c9d74b660ea8bf9cf36e7dfd436df609392127a7fd2d25e4a73eda/7e6ca6 
222b8e161cbc5fba915d20ed6c3f0c6f7526ca97890d8c24597ce545b1e212fb 
232ecd1594f1bc189386283aec3f58a0faeccaldd1104c80a65b54a379716c87 
2337b867ba75be2ec6f1875c936c334e690e70803836f228218b373c59af2Ffcc 
2468c116fbc5bb5d655cffeffd719713ae452acdle3c78bd2c9feb095cd5cbe8 
2490346bab166bda27784aebb6abfb901ec8c31886352d977c5d0536c678b43fc 
25add11d66040c5756d6elcee59bc3e9c5ecd14ca4dd5b0c9ed991b933898c07 
25f587f9293cf6df19255c64eb29614331201b3b47072195ee0cdda55826d534 
2663c11155339c9da783a558efa38c25f428aa86bb5399c25fleb1d25e732f97 
26819f449dbfd75ebf2bbb5b6cf21229fd938d057771a9fd74ac28409111d2a0 
26b2c8ceb1d451d1e93ff1c6229b777e77616abd07b64bac2559c18af267f1c2 
29344e7092d7812f3e3d66223245b28258cceca3aef7450446094f2a4afe43a6 
294a220cfa3675df66875b81e671600b72a00089bc7fc533c38bba972b83df40 
2a48ea40bda49df5299b61352a8517844514c737859121308bea23fdb36ef2a2 
2b6d621264997b87796442ebd3cef538f513bdd760eeda865b5fa01lbd0c6ae93d 
2cd75ebd673f90ffd220eada6c23a7c3bab6bd65373f2ad21f04e9fe0a3330a2t 
2cf6f97e357019bcde90cfeb07d664c27738ac57c71878274a68b168c1ff362c 
2ddc96ce6263cb86da936ca7bffdafl4ca9fc282bf3191c773e2a2138b59a211 
2ee32b86f64f031ba0ea9c0338e5a05d755afb2f92d6345cfed12869b2b229a7 
2ef37e17c2d4e7bbcaf32dla3cbdd930dee84cc69ad4b5c5b61d7e668371e471 
2f6536cd2911877579d15f06a8cbb9e8alb38b30fbbale02f87656506ed14e44 
2ff46bcd28e4741fa3ccd7168e0bfb3c726feeff9f485009a6136e8c21dc7328 
316d5e87447ff9ae455f39943a3f62754ab8bf59b58ca01e536bdbc35a398cbc 
316dc156b5cbc2667a692e0c4b2872e36fd40a557b56039aale8b78e955aa905 
31a252de3cda5129ee70ad35e122d0c16f8d1588cbd800ad335e93f25852ad32 
32c02dca3807ee08769be869298695c0a6f42a85567184f6041da6798cfa95fd 
32e7e27ee627b7f5f2cc87646806aldc418e658abbad41ee120ce71d97bee711 
33e3bdda78378fc3176e4366fa4307cfa08e6ec5d62a6f4b965ad2cfe98ba24b 
346ab3fde761b60b51e396d9c6f7 3fe422f35cddc15f7df82780c4050b9dabc3 
36b2ebd67e048f439bedb33e715c90f628780654e7cdcb5a0576e568fe8c39b8 
3710fa3fa5f706a79b052f37f0c9e21bbd23d20fb2012be847cf250315181436 
376a64bedc7e8d6765d95b93e820756ca7ef387d24aa45297b1d825d25ecaa0f 
391b3c42a7a085bf8faed2d50d7d27aael5alf02bb9d5fb2b6addd0b388b8575 
393a47fc36abdb40dca0c284eb095901fb849143789761665ee2598d993bb033 
39587f141a90d4946782c95e75d672932749304aa32dd7fad1d9974f2d691d63 
26 


3a6e2cadd8d4303ef21e39dcac3d2416cac6b9f514059d8184e7bfllee77b801 
3bed8a6e4eb5e9ca916bd155906fe707aeldc41c31c1lce7e796b480196d6a2fb 
3e0169e424bc5395904bcfdf9d0f7 eb6f7fafc7d3d197f228fef3e974677deacO 
3e9bba8bal 8dbacae4c63faff36dbc2d6188c11fe2bad163988718033fce2df7 
3ee695468e4afb12c30e2dc37935828e06d0866637cd572901c88a4d8c211fdb 
3f0323572f48ebac6d75fd67359c580135a30d80a7693b520b9432d9146d86e8 
3fc2b3fae8147f6649aed2a8719b8771778edc048599217d0cd22c5e70d0dc39 
3fd8180a923869ea42540151e384cfcb163d07dedc05b1f9142a970c3dbca614 
3ffe69c9e2e2f8a350f7d2ffee64acf8cffbf390489807b81cf8e4eec87d4047 
4011f7d71001982ea1c6815cbe6e747f19bbee86341d8Ff280 7fefb50e080e84e 
41cab898ef2d99eb5fel29985763228bb1d102dc66842889d1be4al1139aceb5e 
431250db0267a5c5394c50bcdbcb1e34475a185c953f6c7b25489044cb83ebdd 
439c8179f7f16d025a756c5e27dal7a2dd1a38475bcefde51f8a391f7ec30321 
43ec07a0ae1787aed9f382d6f961843c84966ef8669bc7b71c875cd9Cc17a7a54 
441ca3aad8111e0c425948750485d274575b7fa26e00ddb23c429fd260a9cObe 
447040fdadfb03b1c7883145193596975fd216db539c3079aa0a9eaOfd68a8F3 
44b03e2f300a980f7d8b43a740049913a1513252602dc7de4f4024569ccbfd OF 
44d79abd26345b8bbe8603be4d607f994564e7a96f6444c8799cca8316414947 
451a2fd94d0ac232e8d243f9f4ddad0a1709048a58365a52240d493cb6f26990 
45e7bef47288c638566e1f0906edd51fleeld3dc137539a291d86f983a0c954f 
4676c4353bfbf014021ad1ce7a59f9a863841904a9639f064b9f5b7f0ab6ba0a 
474ec542cc0db502612b2df8df7f06e5d46188cc5c25a19218596af184fddd35 
48b6c7a03efb45af665ala0c291d7ede66560a2da00C957 7dal 9bab3ff23bd43 
4aa7eb4a4e1c54d6f990cda0b1789e2bc38028e599bf97db72acc137b68a5891 
4bee28337a884c4e60834323630c8c81cefc02ab4144b7d4657817aebea02365 
4d0c99bef69a899989b4fd44524616986fcc5c10346f1b74cbec9e3c0c05293F 
4de00d4f21465260f7d67d3fc829ba7124ab5324def519398dd98fa74f675f95 
4e6f0988adc75d578451338397710b3f9e07de7b3530335db64da5f0d9b587b3 
4eef76df493c9cf94149366517ab6bd8bd7f4210b548c2766067f2cb00c1dce50 
4f4cfecce8e006d342624d6df7 7527229fc19a72d62e20b83a58724e2d9309da 
4f57ba579al5bd0bced0e1aa31fdcff9806c007b004e4fcb86532e69e52fd734 
4f9c8e494ef8bcb6f94ebeabd6bab47 76db239778031e1596db370c74a3c94422 
50f60b18f9b006f453512f629112286b804226c82efec01843161e7851137c00 
51be858e35374462a81d6ac2255c62c7aec3eef37f5a25340d8c9602f9fa60bd 
5266c8e3ade83d4aadce4277ddc59dbc68262030e4ad2dd37273c1370aef65f1 
27 


52c02a0f2d6ada3b0e27 7df6cdcdaeb9e3c232c9c1ffofca609a316c93d017c8 
539f252b37e7b1f2b94f513e91f979e026d0a0999d51e09a0624cbbfaaeae479 
53e26d3ea6898d8e6d96336bc0e1ddad21843e4bdf18876522b4dd26f2fe5572 
53eed8562c117904b218b2ad0976e43b499c7d70a267b377cdd887fad1ld3a29d 
55cb6e4d3cca245586ab253f83022aa6480373ee45c62086085515f39a26f318 
55e10e3ac2342c0ac29e8a6007e51c852edfc1218c431369a5b1b0aldd7e2253 
5669950c16d76be24f5394983c2e91d22b6b1582ab1e78699ed533df6dcbc192 
56ae25ec5b26379514f3cb00a72e4964b94173eb369c5f05e34fe749d6e85d2e 
57a02fe0a187a210042ac518f4f55e3452f9bd1aal1680d3ab4437d7ba6c58c43 
57d70632eee9752d450ba8fde366824c5e195c6624c910e272f5d30ccad3766b 
581042b5b9b2b4d37dd670341f556f98791562739b4c3fe3f416e83163051e32 
5863c04d10382cd956f87433d2bd68dcac68eda7c88d7f5970eac64b60b33f73 
586613a2506f708c525ba505a0724217d957987cef748931a0834c36e83adc66 
5958185f009aead056104cf9525882d685d5e739bea465325e21307857270b71 
596eebdb10185419a2e5f5b1836b7d11e472f637f63b0612219bfddeel793d29 
5a98f67175dad747f2b4d3cc7 9bfdfd9fe28b4f2528d1b7f4799d27f62a39231 
5e2c927cOa5b6fdc9884bfle212554942ff72437005f88611e3dc635c0a28a72 
6148471c594ff12e93a4dbe51d0ea958cc590d1852426c656a47e0dc8a95ad09 
6171d9d842177c2519f7d0bfc3982b341b0f6fb9de3d72f09cbb10e991114c17 
61a385620023354b1ed3943c013c283e7ac8e0225090d413e1f15c6edc7b6170 
6200fle6b2c758e70b2e9f2f3166e4ed5f595081a36db3e647ed516272054ee5 
627f1c4522ebd5565d288793080603b32a0cb273d30920038669b50aff38efa4 
62e51d2de62215019d0c9d4a52ad1760cc18644b9679 7ffff90aa887d804ffe5 
62f8c035666fe30325747701cbe7del1cbd2c0094c207ed9feecb76f970683b9 
63df016ec0690ddabd61a6e499a6e01fF48b5d4f46e58d67b581fc22654f9005 
640967 7afc12251078de62c98d0671a6alcelf72217bcc5e084b5f84f8a6c79c 
64232a4dd1719fc9c4a5c7f00adbd4529dec86e5a956e4ba82ff0aa7e15e0f01 
66d77c256b453f9cefed52b35b9c82f95 7f0669316acdce52d24958235c4742e 
66f43fbb336dc9d743759dbe147113645336e62a35ddd0e25cc506blellae86e 
67262c8857e4f6b68673ba61b19c5fc9b81552794c9f2768a92e675cab68abea0 
673722230f682ee92d16e719f85652a34ef13664ab1341d6d49b90b904b4b455 
6764adef097a27375ea4a5921e51dbd8048ff45f10c8ab85d5050433df0b6334 
67b71691690e9cc56ca2e67a6889bfc1c92add9ala7a3c499779f2492d8fedaf 
69b9cce961ce3985c54074aa2c9bc7632969380998078b9c8963ec3031b1bf67 
Sample domains known to have been responding to 104.18.23.52 include: 
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hxxp://bafybeifoiwykvei2k2bk5neozkm3f4gdbh6d2agg27alkqq472q64kfcvu[. Jipfs - 
[.]w3s[.]link 


hxxp://bafybeiarfn4y7pqaowxql6wbkuhi5izp76feqm5oockodhtskvv4h74kne[.] - 
ipfs[.Jw3s[.]link 


hxxp://bafybeieq7yeiaqgp6xqpkxqg3znepunqbtaakmmb4343a4wxyp4vq2nikm[.]ip 
fs[.]w3s[. ]link 


hxxp://bafybeigvjkqkq3s2sz2stcqjqS5uve206rmiew2occt4bazz62!qbnoj7ku[.]ip fs[.]Jw3s[.]link 
hxxp://bafybeid2udy66wb3k5tvouvyh5vlkzod7jtknilwp3buk4c2rc3vb5p4rja[. Jip fs[.]Jw3s[.]link 
hxxp://bafybeicdnf6pnveiegielvgfd4dgfwb4bs3er6tdv54z3ajxiartcgtwza[.]ip fs[.]w3s[.]link 
hxxp://bafybeigxwyg4nnyy62gxpzkc2vker42|4zab3dxmé4taqspiviqxtyxojoyl[.lip fsl.]w3s[.]link 


hxxp://bafybeieoehbi3bozw4rhtadsuw3wizt6or4dm4afhocd52nt2w4mwmcjsil. ip 
fs[.]w3s[. ]link 


hxxp://bafybeiah6u2xz7u7lgqbrcjx7dkleth7od2ruwb763scrx53uv6dyyidte[. Jip fs[.]Jw3s[.]link 
hxxp://bafybeiarotivhIx6aowgrqr7wwpnph74fsvk7ausj5amtz4lz2tgtsscf4[.]ipfs [.]w3s[.]link 
hxxp://bafybeigno2w5vo3wft7vaiw2emsokkdp3q4fxj6jofuoeki6pr5itmjvxyl[.]ipfs [.]w3s[.]link 
hxxp://bafybeibgwyojlbt5hivhyxftcmdiiwd4xsx24l3zuyintzqdcqimgtyssm[.]i pfs[.]w3s[.]link 


hxxp://bafybeih3semybz46v2auyau6bwbb6bmn4vnnadw4ra6pyifniuamwhebdm - 
[.Jipfs[.Jw3s[.]link 


hxxp://bafybeihg2js6ljraoyz5agtnqwngknvtqzgcexfaqg4ifu5 7s3hmve67hm[. Jip fs[.]w3s[.]link 
hxxp://bafybeic4y7xrpjrqp2jubl3btgyjd4vu44xp3t3v2sdyaquxt2oiamiujul.]ip fs[.]w3s[.]link 
hxxp://bafybeibn67lgqdwhfpf3bI5vg7bako3e5x5bj3b5uxm3o0xn3lcz7xbrrng[.Jip fs[.]w3s[.]link 
hxxp://bafybeicrq3hypfwbpghncpcubit7 xrnvfncw34s22jc5u622e6zgit6t5aq[.]ip fs[.]w3s[.]link 


hxxp://bafybeihmtlbpmza7wjzvjsomq6kaestvee2o0szw2a5pimjhpxtju7p4msyl.]ip 
fs[.]w3s[. ]link 


hxxp://bafkreialqhpgku7 66iujjzyvkp5ti52svsidzmxh2m22volxvsqitvxjqil.lip fs[.]w3s[.]link 
hxxp://bafkreidjv4vdxf7pl5b2hctutntnapfjorzd3dfcft6t2 3wkbveguyndmn\[. lipfs [.]w3s[.]link 
hxxp://bafybeicwr6xv2jvegkulb7aelxftow6ipqgiyumcrl6yonyvrajhéisyfal. ]ipfs [.]w3s[.]link 
hxxp://bafybeide2cap7dwaz7noybtd6rkj75afd2g4ktgndfhoijnm3hixlomzim[.lip fs[.]w3s[.]link 
hxxp://bafybeibzdym2xb6sticxgaejsykxj4inc3lisdyecapdv7ursp6vilw54e[ .Jipfs[.]w3s[.]link 
hxxp://bafybeigpvsxliiqnp4zrzsvtox7f45w3kxlihnfv7lauby3pv2pmjbtxb44[. Jip fs[.]w3s[.]link 
hxxp://bafybeif35ymavla27r645kib4tcgve3qIrzubbijzhq3dscrbmcihj6myal[.]ip fs[.]w3s[. ]link 
hxxp://bafybeiggma2d7 7tefczrifpzSwwvhvw2wrcfko2wdk/7/sifdd33kmtc5zru[. Jip fs[.]w3s[.]link 
hxxp://bafybeia2h5v7itkdr3c3njrktfxpnucn 7hjlrxtr2wegy2bawd6muumscu[. Jip fs[.]w3s[.]link 
hxxp://bafybeia5aj45vwoxl3ieojp2ek35c7cjbz6zqp3whlly5zhilcrjz5hqfy[. Jip fs[.Jw3s[.]link 
hxxp://bafybeiasmsxxjzhmrgusj3tussufgz6vt6 3nupiv2mvffvz4ksp6yiydf4[. Jip fs[.]Jw3s[.]link 
hxxp://bafybeifo3sytrpilq7t2jshaziweqy 7zyk6whzh3quta6jnjbg5v7nslae[.lipfs [.]w3s[.]link 
hxxp://bafybeif5m3nfcet6xtxuiocna7pesiiepo76apkndx2vry52elx2x7px2q[.lipfs [.]w3s[.]link 
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hxxp://bafybeiaemax6uhu6t2ujov3uzdufnbcrdzs7hdwtict4h3ucoxrb4whbey|[. Jipf s[.]w3s[.]link 
hxxp://bafybeifv5 30wjok44tyv7mcge3kpehmfbdtnpfgof7heik2j7pneg7eai4[. lipfs[.Jw3s[.]link 
hxxp://bafybeibew7|k2mf66wa2gi6d3ezutp336vp377c2hiilib4bdzhrji2wvel[.lip fs[.]w3s[.]link 


hxxp://bafybeicsrkxc6pvn2nwzd2wivjwf52n2mn52ulmwhrwndbebmlebpfrhpil. Jip 
fs[.]w3s[.]link 


hxxp://bafybeifrq3vagytnbl4uw 7hqjvpgdn57pdksuvdg4ovtblsbqrgedk56nm[. Jip fs[.]w3s[.]link 
hxxp://bafybeibgivahg2moxn6qoaqttk2fbkcuvmjhmxxi3bz4tngcjgiyrr2z4vil[.Jip fs[.]w3s[.]link 


hxxp://bafybeiftny55ajmwwwzmmyxxjld2aowz66 3iza5ti3raxukknv7bqqnk4q[.]ip 
fs[.]w3s[.]link 


hxxp://bafybeigbpv4lfshncbqlgvnupht3h6tkcmrermyu/7ctvfzoqcu62o0shq/7a[.lip fs[.]w3s[. link 
hxxp://bafybeiaix7ewvyraltg67j2puatq4xllzvoch3phd3hop32rtwn2jn4dcu[.]ipfs [.]w3s[.]link 
hxxp://bafybeigsx3nzfrocrgg5sryqwb3rcfw /7g3o0orzug3elm3zk7hjpkablpse[. Jipfs [.]w3s[.]link 
hxxp://bafybeifzbqdck3anxdc52kqt3cztk2fwwmlis2y5 74jd22moifmfsvpcxael[.lipfs [.]w3s[.]link 
hxxp://bafybeidit3 mup6cs2j6zr3ggs6rqjwwcmm 7uahw4izkopn7fihkrdczr7a[.] ipfs[.]w3s[.]link 
hxxp://bafybeie2bfzupd7ak53xz4imo4lytra5dlr74zyshuapokjwlvkitqle5e[.]ip fs[.]w3s[.]link 


hxxp://bafybeihlwm5wosfdfep67kpxsposkmfy2pg4ty2y6ovgyqeblic5mtq5rsyl[. lip 
fs[.]w3s[.]link 


hxxp://bafybeigqbqkmlulrauaxjqg5mw2sjvml6ysjmsvgkourxm6t7gncqiejnum[. ip fs[.]w3s[.]link 
hxxp://bafybeifukg3y6ktng4u3bhwtigo7w7kgy52|bhsrtb2kgyxzcd5ihzr22baq[.lip fs[.]w3s[.]link 
hxxp://bafybeigpjhe4044q4cycljov3zzkdl2ryjvv57Imr5pvekgtjye7budrxil.Jip fs[.]w3s[.]link 
hxxp://bafybeicqu6ecliqdjlu6h6q45voumkz6oef5qbgsakuymiaovt2ftéqtzie[.]Jip fs[.]w3s[. link 


hxxp://bafybeibucwomwhuava4é6rcskf7vp56lb2eekoqbg636t3nkfmizzysgrye[.Jip — fs[.]w3s[.]- 
link 


Stay tuned! 


1. hitepa:/ blogger. googleuser content. con/ing/o/R29v22x0 /AVWRsENDGibwdl20unTTebl Pal RoEOabi6QQb0,qB¥iCTO7 y=02 
2, cepa: //blogger .googleusercontent con/sng/b/R20v2Z2n1/AVWaEheSiniN j2VUSpHG-Nhsdaiuip jePaVSCRGYI_o2VWI_ a 
3, https: //blogger . googleusercontent . com/img/b/R29vZ2x1/AVVXsEjNSK7dWwhJ jRnsweT_9QWC8RUXF1GrYdTbptzs09ygN3LF5KK 


1.1.3. Dancho Danchev’s Blog and Twitter Account Ebook Formats - 2019 - 2023 Re- 
search Compilations Available (2023-03-07 23:55) 


HH 


[1] 


W 
oO 


DY Dancho Danchey 


Dancho Danchev's Blog - 
Official E-Book 
Compilation Archive - 
2019 - 2023 


Https://ddanchev blogspot.com 
Ematl: dancho danchev@hush com 


Hot off the press. 
- [2]Dancho Danchev’s Blog Official Ebook Compilation Archive - 2019 - 2023 
- [3]Dancho Danchev’s Twitter Ebook Archive - 2017 - 2023 


Full portfolio of research circa 2005-2023 in various Ebook formats available [4]here for free. 


Enjoy! 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEgRuo44F gd3ivMij9tkp77iTJIKVVGQA1s0f eqgAONhJat44p 
84qFR81TYdTzDrLKxY9VgGUryZIf4IsSzVNQDBwwe4m0istwO8RY11q 

2. https://archive.org/details/dancho-danchev-blog-ebook-2019-2023-02 

3. https://archive.org/details/dancho-danchev-twitter-ebook-archive-02 

4. https: //archive.org/details/@ddanchev 
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1.1.4 Cybercriminals Offer Apple Themed Discounted Products For Sale On Major 
Cybercrime Friendly Forum Community - An Analysis (2023-03-18 07:15) 


[1] 


I’ve recently came across to a currently active underground marketplace forum proposition 
that’s basically offering and selling Apple themed products which appear to have been ob- 
tained and purchased using fraudulent means. The seller also appears to be using several 
techniques to actually safely ship the products basically everywhere and is using another ser- 
vice to guarantee the payment and delivery of the products. 


32 


Sample screenshots include: 


[2] 


[3] 


33 


[5] 
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36 


[6] 


[7] 
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Sample underground forum proposition: 


"The product is only original, packed, new! Absolutely the same as in the store, only cheaper! 
— Apple products are a priority and are always available at the drop, the prices for it are 
fixed and are indicated in the price list below. — We send it anywhere. — In order to protect 
ourselves and you, we will work only through the guarantor such as forum escrow “We can 
overpower any volume.” — The goods pass the customs control without problems, sending 
on the left waybills. — Sending goes from my drop, take on SAFE, there is no risk! — When 
ordering from $1000, a nice bonus in the form of an additional device! — | always give the 
track number! (number to track the parcel via the Internet) — All GSM devices, neverlocked, 
will work with all telecom operators! *Dear Clients! Read carefully all that is written below, here 
all the conditions and nuances [Payment] — The minimum order is from $180. — We work only 
through the guarantor escrow of the forum! — Write to the Forum guarantor the application as 
indicated in its topic. — After you deposit funds to the guarantor, immediately write to me, we 
will process your order. After sending, | give the track number. — Major transactions in priority, 
we process them faster and more efficiently. [Delivery] — Delivery by mail DHL or Fedex (we 
can consider other companies), anywhere in the world, no longer than 15 days. Usually 7 
days. — The delivery is included in the price of the goods! — Before we write, please read 
the topic, you will find answers to many questions. — If you do not answer immediately - do 
not panic. we receive high volume of emails and orders. — Subject for feedback, all questions 
in the PM! Recently, unscrupulous schoolgirls are thrown on different shit forums and social 
networks, impersonating Serbs, therefore, when uploading photos to the forum, watermarks 
are automatically applied. Operating since September 2011. Building a good reputation is one 
of my values - | will always do my best to surprise and stay reputable. All iPhones are sent 
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undamaged in their original packages. It takes 2-4 business days for the products to reach any 
location within Europe or North America and up to 6 days elsewhere in the World. All of the 
iPhones come in stealth packaging, declared as items of lesser value. You don’t have to worry 
about customs taxes as it will already be PAID for by us. Trusted. Safe. 100 % Satisfaction 
guaranteed.“ 


Stay tuned! 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEhbvHOFCqznIn4VX-W4L1i412UU_Awt 7OueSohyuJ8TNe2QT j 
X44rA6QK9140rxJjyIVcChudf4X4nF1A7WzsOXB3kKBuzQG198bz6b 
2. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEjkhB41TXCZbQMXusZdr2HSgWMEDOF60S4i3xekSvkIL6j7 


ye24YDo0EvhD9dH5g8RGf0 JeLhI2UE2V6iTo2Y-riGdXbR_Wmar4Rq 
7. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVvXsEiBA7UY1BAJPQQSO_XJuLvSc6M- 21Z0XdpNYsHx1qRngzv44 
8q55YH4YuD1CEVQWWmF bf Y211sXUVboe JXmU0ySmorzD5Q8abF006 


1.1.5 Profiling a New Vendor of ATM Skimming Devices and Stolen Credit Cards In- 
formation On A Major Cybercrime-Friendly Forum Community - An Analysis 
(2023-03-18 07:19) 


HH 


[1] 


3 


Xe) 


I’ve recently came across to a currently active underground marketplace forum proposition 
that’s basically offering and selling ATM skimming devices and stolen credit cards information 
where the seller of the devices and the information is basically offering a variety of screenshots 


to demonstrate the existence of the service. 
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Sample screenshots include: 


[2] 


[3] 
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Sample underground marketplace forum proposition: 


“USD/BTC Mid-Balance Clone Card (Price: $260) High-Balance Clone Card (Price: $400) Super- 
High Balance Clone Card (Price: $875) Card Balance $1,300 (Min) — $2,500 (Max) $2,500 (Min) 
— $4,000 (Max) $5,000 (Min) — $8000 (+) ATM Withdrawal Limitation $1,000/day (2 Sessions 
of $500) $1,000 — $1,500/day (2-3 Sessions of $500) $3,000 — $4,500/day (6-9 Sessions of 
$500) Banks Chase, Charles Schwab, Capital One, & PNC Suntrust, Citi, Wells Fargo, BB &T, & 
PNC Goldman Sachs & Private Personal Banking Card Type Debit Card, Bank Issured (VISA & 
Mastercard) Debit Card, Bank Issured (VISA & Mastercard) Debit Card, Bank Issured (VISA & 
Mastercard) PIN Four Digit Pin, Overlay Pin Transmitted (Multi) Four Digit Pin, Collected from 
Overlay POS/ATM Four Digit Pin, Collected from Overlay POS/ATM Data Acquisition In-House 
Skimmers & Skimming Network In-House Skimmers & Skimming Network Skimming Network, 
Subordinate, & Private Sale". 


Stay tuned! 


1. https: //blogger.googleusercontent.com/img/b/R29vZ2x1/AVvXsEi j IMDwu_HXvxAa9zEgZMgKCgZMw1hBG19K8yM5dtB2in90f 
XucOOODKil7ImkkK4axfgTBjuiBFVxqikKbGUAPIAQE24HNhJ-mhLTTY 
2. https://blogger . googleusercontent . com/img/b/R29VZ2x1/AVvXsEgx87 QpyC5VgN78Ph7 1EnI JbXWOw12PeWAQY1PLbcTXenWWwWk 
ZKROOXA3wafTEBsf£X2_YhVYtQReYZ5vXehg3lylbxYeLBLgk8cArp 
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3. https://blogger .googleusercontent .com/img/b/R29VZ2x1/AVvVXsEiN3Bsv7x9F rutMX jwSQjq8_TpqHxiLulimSsTGDQHL7GXLf 
hCa2R0zw0ZQ3jT7qvSouSgI4-uikW91NOxxgqyBtsKLsMpxCN70Hgz 


1.1.6 Profiling a Currently Active Vendor of Western Union and Banking Logs Includ- 
ing Stolen Credit Cards Transfer Details - An Analysis (2023-03-18 12:18) 


[1] 


I’ve recently came across to a currently active underground marketplace forum proposition 
that’s basically offering and selling Western Union and banking logs including stolen credit 
cards information where the seller of the information is basically offering a variety of screen- 
shots to demonstrate the existence of the service. 
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Sample screenshots include: 


[2] 
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[3] 


[5] 


45 


46 


[6] 


[7] 
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Sample underground forum marketplace proposition: 


“My team specializes in stealing financial data such as credit cards, bank logs and other finan- 
cial instruments from hacked databases such as e-commerce websites and spam for card data 
using email skimming/phishing, SMS and website fake login pages to extract card and bank 
information from victims. We use this data to transfer funds to you using western union, Mon- 
eyGram, bank transfers and cash app, etc. We use westernunion.com and moneygram.com 
to place an order to your pickup info and order using the victim’s cc data. We can also do 
bank transfers (wire) to any bank globally as we have data from all countries in our logs. This 
is fraud and illegal, so anyone wishing to use this service should take precautionary steps or 
contact me for essential advice if you’re looking to get some easy money. | recommend doing 
these transfers only once per account/name as it gives a higher percentage that your accounts 
won't be locked afterwards or, ideally, use fake IDs/drop accounts. We sell on multiple dark 
net tor marketplaces. You may find us on other marketplaces.“ 


Stay tuned! 


1. httpa:/ologger.googleuser content con/ing/b/R29¥22:a/AVWRaEgCVAdyyrP9aVUel 72sbToAQuMipANAEcSqS30VRINSTH 
2, reps: / /elogger. googleuser content. con/ing/o/R20v22x1/AVWEsENESZjyByeAGvace®3_CjENQEAQUTETlFadRgkDPoDNRTaA 
3. reps: //logger. googleuser content. con/ing/o/R20v72x1 /AVWEsEAL3gWaty_sUqKE3Ha7bra MAD BNpiIKodeWOxIAh TuNDg 
_ https: //blogger googleusercontent.on/ ing//229v2Z2x1/AVWKsEAU__060qSqqpAbuilv Yout ADT2 Ear 0xGyDaCDBWENPT2 
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ms 


aN 


5. 
6. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEjPFMjtTG4jC_Fu0kh_XPcVogBbzxEgwZwpf5_28ESv7thCp 
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1.1.7 Profiling a Newly Launched E-Shop For Fake IDs/Documents and Certificates - 
An Analysis (2023-03-18 12:22) 


[1] 


Login 


Registration 


I’ve recently came across to a newly launched E-Shop for fake IDs including personal documents 
and certificates which offers a variety of some pretty informative infographics on the topic of 
how to obtain and actually purchase a new identity based on a variety of countries. 


Sample photos include: 


[2] 
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The minimum cost of 
r($) starting a new life 


alll 
ial 


UK 


4 
im « 
* 


CANADA 


AUSTRALIA EUROPE 


1200$ 1400$ 


500-1000$$ 


1250S 
500-1000$$ 500-1000S$ 
5000S =700S § 5000CAS = 700S—5000AUS =700S§ SOOO£ =700$ 


2350$ 2400$ 2600$ 2450$ 2300$ 


) New identity inckades Passport. 1D Card, and Birth Certificate 
& Education includes High Schoo! Diploma and Bachelor's Degree 
© Finance includes Bank Account, Credit Card. and 5.000 of Counterfeit Currency 


1100$ 
500-1000S$ 


[3] 


The cost of a passport 


Europe 


US$750* 


Canada 


US$745° 


Australia 


US$745* 


& 


USA 


US$850° | 


* Average Price 


[4] 


500-1000SS 


5000€ = 700$ 


"Car 


new life in Europe 


Cast of a new Identity: 


Passport - Starting at S$600" 
ID card/Driver's license - Starting at USS 


Birth certificate « Starting at US$220°" 


© Cost of a new financial profile: 


PayPal account Bank account 


Starting at US$70 
Credit card Fix your credit history 
Starting at USS45 Minimum US$200 


Counterfeit money 
€5,000 costs US7005 


=) Cost of a new background: 


High School Diploma Certificates (any kind) 


US 5005 US 4005 


Bachelor's Degree Fix bad grades (college) 


us 7004 US$1.200-US$3,751 


Master's Degree Guaranteed Accoptance 
us 10005 toCaliege- US 43005 


verted from ours 10 US 


[5] 


Bi SUMMARY 


The minimum cost of starting a new lite 
infuropeis US 30505 


Now identity 


I5$1, 125 


Education 


Finance 


US 8005 


aL 
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a) Cost of a new Identity: 


Passport - Starting at USS660" 


1D card/Driver'’s license 
Starting at US$275° 


Birth certificate 
Starting at (S$240" 
wz _) 


en 


a) Cost of a new background: 


* 


} A new life in Canada ; 
ss 


© Cost of a new financial profile: 


PayPal accourt Bark account 


Start 


at USS125 Starting at USS7D 


Credit card Fix your credit history 


Starting 


et USS45 Minimum USS 20c 


Counterfeit morey 


High School Digloma Certificates (any kind) 


USS500 


Fix bad grades (college) 


YUSSS 


Mastor's Degree Guaranteed Acceptance 


usS1 


1 000 to College- USS4300 


[6] 


The minimum cost of starting a new life 
t 


In Caracta be U5535, 200 


New identity 
y : +f 


Liss 


Education 


A new life in the UK 
<> | 


a) Cost of a new identity: © Cost of a new financial profile: 


Passport PayPal account Bank account 
Starting at US$710° Starting at USS$125 Starting at US$70 


[hnpeeraty cy frneity| 


ID card/Driver’s license Credit card Fix your credit history 
Starting at USS305" Starting atUSS45 Minimum US$200 


Birth certifreate Counterfoit money 
Starting at USS240° £5,000 costs USS700 


6 Cost of a new background: 


High School Diploma Certificates (any kind) 
USS500 uss400 

Bachelor's Degree Guaranteed Acceptance to 
USS700 College - USS4,300 


Master's Degree Fix bad grades (college) 
US$1,000 US$1200-US$3.750 


6 New identity 


L 


The minimum cost of starting Education 
Hi , 


a new life in the UK is 
Money 


[7] 
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54 


& 
¥ A new life in Australia 
ss 


© Cost of a new identity: 


Passpor 


Starting at USS4& 


ID card/Driver’s license 


Birth certificate 


o Cost of a new background: 


High School Diploma 


USSS00 


Bachelor's Degree 
UuSS700 


Master's Deerce 
USS1,000 


Certificates lany kind) 
USS400 


Fix bad grades (college) 


US$1.200-US$3,750 


Guaranteed Acceptance 
to College - USS4, 300 


[8] 


-% 


© Cost of a new financial profile: 


PayPal account Bank account 


Starting at US$225 Starting at US$70 


froemh ont 


Credit card Fix your credit history 


Staring at USS45 


Counterfelt money 


AU$5.000 costs USS700 


ew identity 


Passport + (D + Birth cortifeate 


US$1.355 


Education 


USS1,200 


Finance 


flun® Accour 


USSB00 


The cost of a European 
Passport 


[9] 


THE COST OF Rm 


s 
* . 
° Anew life in the USA @ay 
™ SE, 
( _ Cost of a new identity: Cost of a new financial profile: 
Passport - Starting at US$710 PayPal account Bank account 
Starting at US$S125 Starting at US$70 
ID card/Driver’s license Stoo On) flrwis 
Starting at US$200 
Credit card Fix your credit history 
Social Security Number/Card - US$2-5 Staring at US$45 Minimum US$200 


“rth F , $7 
Birth certificate - Starting at US$240 Counterfeit money 


US 5000 costs 7005 


2 ea 


(ss ™ - 
ee | B SUMMARY 
T The minimum cost of starting a new lite 


- in the USA US 31505 
ip Cost of a new background: 


That includes: 
New identit 
HighSchool Diploma Certificates (any kind) (Pecutevt > ray oh Covtiheste? 
5005 4005S US$1.152 
: Education 
Bachelor's Degree Fix bad grades (college) (igh Setreacs ditdiuenae > Ractichar's Ono ¢ 
7006S USS1.200-US$3,750 US 12005 
Finance 
Master's Degree Guaranteed Acceptance (Rank account + Credit Cant + Comemertelr money 
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Sample underground forum market proposition: 


“Identity card / social security card - A passport will only provide an opportunity to enter the 
country, but in order to be considered a fully functioning member of society, documentary 
evidence that the person is a resident (or citizen) will be required. Each country has its own 
specific forms of identification, but all use a driver’s license as their primary ID card. Therefore, 
both documents are necessary for those wishing to obtain a new identity. “Birth certificate - 
This document is necessary to substantiate your citizenship by birth: to be able to prove the 
fact of birth in this country and that the name, date and place of birth correspond to the 
new identity. As is the case with real citizens, this is an important document when purchasing 
various government services.“ “Education and qualification documents. The key element of the 
new personality is the person's fake general and professional education. These documents help 
start a new life - create a completely new backstory with which you can already get a job and 
find a community. Among the documents about education, we make diplomas of secondary 
education, bachelor’s and master’s degrees.” “Financial documents and services. Creating a 
new financial profile is another step towards creating a new personality. Anyone can update 
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their financial status with new bank accounts, payment cards, credit scores, and even new 
PayPal accounts. All of these solutions, again, come from a wide variety of sources. Some 
bank accounts have been stolen, others are legitimate.” “Estimated cost of a new personality 
by country: USA The cost of the minimum package is $ 3150.“ 


Stay tuned! 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEh1 XvLmGHBMzD-LYpIJJrwz_laAccHalwYPXH4k0Q48M1Kj2 
Q-Y12gYS7g-BSfOh- qORD9rEcVzZ17ND3i4Nrt1tR5SDJvwwGBOgXxTLA 
2. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVvVXsEhF gLsxKMS22BMx4MwXt9M- 4KgSPr4QTbVhTboo5BBlg_td8 
UOtTPbMLMjRloonZH7EpXxgUmZMGP-gXw1iSK_5FJA__SriYkmFiN1Z 
3. https: //blogger. googleusercontent .com/img/b/R29vZ2x1/AVvXsEiuNZ_VZU0uWXyPa2Kcci-8FnU9- 1WtHdSww4qs1PNwNItwr 
FMQ-mLjYuuLr_MeQyoUaLhkKTZs_z2U2vGitXFF2TYPegRebORSKpGq 
4. https://blogger.googleusercontent.com/img/b/R29vZ2x1/AVvXsEhp5 jZzzzzuESVC8gZaJMYfiztigOY2rybugrkPuJr5Eugv- 
kam937dqR8egTo1X3mZ7hjzqJHr5FonCxeBkEgRjNWxe4rYId94p0q 
5. https: //blogger. googleusercontent . com/img/b/R29VZ2x1/AVVXsEiS10bwX12Jvajv9-ApGx j-EToCxYMQKXopu4zY5xJdKytHV 
cwl4VNZ_KIMtbLyL5df jKOoJ-OQqgXSek1wUHQBoQrckcSmhDwxXVwrn 
6. https: //blogger. googleusercontent .com/img/b/R29vZ2x1/AVvXsEg7mQwyh5N1 gf 1YCKxutFEL4RIf2F6--RKUtH1hYGv_RLLaE 
4Lf£SjrMJGOZMZECSqF qRVVNrG6Y j TUNJFAhsOaYNp1n1i8BichYwmQ4 
7. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEjrk7gtC97FMmEhNOeKeAANc1LidJ3DPzuCVOo5nLax394ho 
aVzdDzf3evFquJxVfCuUI 3nhbh3hA-VNOTqdyqWoYz2FRxVOZB1x-Z 
8. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEgD81ftPnBzsmFnwDXt jhDinQ1S1kK57ZrF JPhnNSPoKAMcd 
K_9YGH3JWO_P5N_eqDo703XdtwR9B11KqfiXpL54LDx2QSw1lV1Lu-0 
9. https: //blogger . googleusercontent .com/img/b/R29vZ2x1/AVvXsEh5ugwCSFg1Vg8pkBysz_uQJoqJIdi81F3-S03Z2gG9gNY6b 
SABHIAHZ07UUshM1rKy jwv/7G9ZbGiB1 2qWv556r0MEwB2Pv1UAGybx 


1.1.8 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information - An 
Analysis (2023-03-18 12:34) 


[1] 


CC + Adibess 
SSN + MMI + Phone 


Retusntetve: FES 


CC + Addiess 


Met uswbatele: YO 


CC + Atichess 


Returetatve: YES 


OC + Address 


Returdatie: YES 


CO + Address 


Bay $15.50 


Returndetvie: YES 


CC + Addiess 


Buy $15.50 
Neturubatele: YES 


CO + Aildvess 


Refurnatle: YES 


I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s 
currently syndicating and offering access to a multitude of stolen credit card details courtesy 
of various underground marketplace vendors of stolen credit cards information and is currently 
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offering a pretty interesting and massive portfolio of stolen credit cards information which 
everyone can basically purchase. 


Sample screenshots include: 
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Stay tuned! 
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1.1.9 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information - Part 
Two - An Analysis (2023-03-18 12:37) 
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I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s 
currently syndicating and offering access to a multitude of stolen credit card details courtesy 
of various underground marketplace vendors of stolen credit cards information and is currently 
offering a pretty interesting and massive portfolio of stolen credit cards information which 
everyone can basically purchase. 


Sample screenshots include: 
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Stay tuned! 
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1.1.10 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information - Part 
Three - An Analysis (2023-03-18 12:44) 
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I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s 
currently syndicating and offering access to a multitude of stolen credit card details courtesy 
of various underground marketplace vendors of stolen credit cards information and is currently 
offering a pretty interesting and massive portfolio of stolen credit cards information which 
everyone can basically purchase. 


Sample screenshots include: 
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1.1.11 Who Wants to Fuel Independent and High Quality OSINT/Cybercrime and 
Threat Intelligence Research? Accepting BitCoin Donations (2023-03-18 22:57) 
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Dear blog readers, 


Did you already grab a copy of my 2019-2023 "[2]Dancho Danchev’s Blog - Mind Streams of 
Information Security Knowledge" Ebook which is 1.7GB compilation for free? Did you already 
grab a copy of my [3] Twitter 2017-2023 Ebook compilation for free? Did you already grab a 
copy of all of my WhoisXML API white papers which | produced during the past year and a 
half [4]here? Have you also downloaded my Cybercrime Forum Data Set for 2022 including 
a free 256GB compilation of all of my publicly accessible research from 2005 up to 2023 for 
free in the form of a [5]torrent? Have you also grabbed a copy of all of my publicly accessible 
research from 2005 up to 2023 from [6]here for free? Did you also grab a copy of my memoir 
from [7]here including a version in Bulgarian from [8]here? Did you also grab a copy of my 230 
pages cyber threat actors compilation from [9]here? Did you also grab a copy of my Maltego 
training videos from [10]here? Did you also grab a copy of my latest video presentation at 
Cyber Security Talks Bulgaria from [11]here? 


After a bit of thinking and personal decision making I’ve decided to begin soliciting free Bit- 
coin donations using address - 15Zvie1j8CjSR52doVSZSjctCDSx3pDjKZ where every amount 
donated will go for me which I'll use to pay my bills including to maintain a decent living in 
the form of taking care of my family and folks in terms of expenses and most importantly fuel 
growth in the form of my research in the form of securing a decent revenue stream that will 
be a personal privilege in the form of receiving it as a donation to keep my research keep and 
running on a daily basis as I’ve done so as of December, 2005 up to present day in March, 
2023. 


Here’s what you can do in order to help me fuel growth into my research on a daily basis and 
help me pay the bills and assist me family with bills and expenses including to maintain a 
decent living in the form of being a noteworthy and a bit popular security researcher: 


* Donate using my _- permanent’ Bitcoin donation address’ which is - 
15Zvielj8CjSR52doVSZSjctCDSx3pDjKZ 


¢ Do it as long as you feel like doing it including as many times and whenever you feel like 
doing it as it really help me a lot in terms of paying my bills and assisting my family with 
bills and expenses 


“biEcoin 


Thanks for your donation! 


Sample photos include: 
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Ematl: dancho danchev@hush. com 
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So, what this means is that any individual's success in the industry comes down to things like reputation, how well you 
can bullshit, etc. But ultimately we have no way to differentiate, say, Bruce Schneier, who has a long academic- and 
professional-grade track record and a habit of writing in a highly intellectual fashion on difficult topics, from Dancho 
Danchev, who ts a random Russian dude very few people knaw anything about, who posts random snippets of facts that 
pass for “analysis.” 
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Russian OSINT 4 


Mutepaio c OSINT cneunanuctom Daxo 
Jiaxuespim. He Ha Bce BONpOCI ynanocb 
NONYYHTb PassepHyTbie OTSeTbI, HOB 
UeFIOM NocbIN NoHATeH. Kn6epxpaiim 
Nporpeccupyer, ransomware rnasneiht 
Tpensg 2021 rogs, a CLUA no-npexHemy 
HaXOQUTCR 8 KOHTPax c Poccven. 
CopepxksHve unTepabto: 


~ Kro Tako JisH40? 

~ “em OH SHaMENMT? 

> PaSota Ha U.S Law Enforcement u U.S 
Intelligence Community 

> OSINT onepauun “Uncle George” 

> Cybercrime Forum Data Set na 1616 
> Ransormware « Darkweb 

> MpvGrinh REvil 

~ ‘Poccua ocraercn MmasHbim 


paccagnukom KuGepnpecrynuoctit” 
> KuéepnpectynxocTb B CHT 


https://telegra. ph/intervyu-s-hakerom- 
Dancho-Danchev-04-12 


Telegraph 

Vntepse c Gonrapekim xaxepom 
Aanso Janvespim cnequanbwo 
ann Russian OSINT: Ku6epxpaam 8 
2021 

Vine, Haxdo faxes / Dancho Danchey Pon 
sakATnh: WB wocregoparenh, OSINT 
cneunanner Creynanvaaqua: KuGepKpaim, 
Darknet && OSINT Crpana: Bonrapua Caitr 
ddanchev blogspot.com Twitter: 
https://twitter.com/dancho_danchev Russian 
OSINT: Qswyo, pacciamn HEMHOrG.. 


te a Awe 19 48 14 RE 
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Ha LOVELY HORSE @ 
@iovelyhorse ouren seve 
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Tweet 


X Roman Medina-Heigl Hernandez - 2c 
tbh, | don't understand what's the purpose 
of this now ?!!? securityboulevard.com/ 


2021/09/exposi 


29a was a well-known and respected group 
in da viri scene... 2 decades ago!! More info 
(spanish); hackstory.net/29A 


securityboulevard.com 


Exposing 29A Virus Coding Group - An 
OSINT Analysis 


© 10 wt? 13 @ 38 — 


Julio @juliocesarfort + 1d 
K it's just Dancho Danchey trying to make a 
comeback after years out of the spotlight 
and battling with mental health issues. i 
can't help but think what terrible doxxing 
skills he's got... 
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© Tweet 


You Retweetod 


TN NETRESEC 

(inetrasec 
Our #SUNBURST STAGE2 Victim 
Table (orgs actively targeted by the 
threat actor) has now been updated 
to include "paloaltonetworks*". 
The internal AD domain for GUID 
22334A7227544B1E was discovered 
in passive DNS data published by 
@dancho_danchev. 
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DANCHO DANCHEV 
SUCK MY DICK 
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iPhonei2 Onlineshopping FWA Artificialintelligence PSS XboxSeriesX SPID 3Dprinters Netflix 5G 


Who framed Dancho Danchev? 


Dancho Danchev, a Russian researcher known for his work against malware, has been missing since 
October and has never been heard of again. 
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C1 « @ humwikipediaorg/wiki/Astala: GF) 


Astalavista.box.sk 


Page type searah engine 
Categories search pape 
Available tanguage (s) English 
Establishment 1994 
Editor-in-Chief Dancho Danchey 
URL box.sk 


The website operated under a Slovak domain name . 
The name of the website is based on a movie pun, In 
the sci-fi action movie Terminator 2 - The Day of 
Judgment , the protagonist's character had a 
memorable phrase, “Hasta la vista, baby.” a phrase in 
Spanish that is a commonly used farewell formula. 
The ‘astalavista’ of this sentence is the merging of 
the player. It's worth noting that AltaVista , another 
well-known search engine of the era that sounded 
similar , was only launched in 1995, *" 


In December 2020, cybercrime researcher and 
analyst Dancho Danchey, as the operator of the site, 
announced the retaunch of the website under the 
domain name box.sk. It is designed to support 
hackers and cybersecurity experts, |!’ 


v Notes 


v Translation 


Be HUNGARIAN =~ ENGLISH ; x 
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It would be really an honor and a privilege to get my first and continuous Bitcoin donation 
revenue stream up and running as of today and it would really help me a lot to pay the bills 
and assist my family with bills and expenses. 


Stay tuned! 
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1.1.12 Profiling a New Vendor of ATM Skimming Devices and Stolen Credit Cards 
Information On A Major Cybercrime-Friendly Forum Community - Part Two - 
An Analysis (2023-03-19 12:05) 


[1] 


I’ve recently came across to a currently active underground marketplace forum proposition 
that’s basically offering and selling ATM skimming devices and stolen credit cards information 
where the seller of the devices and the information is basically offering a variety of screenshots 
to demonstrate the existence of the service. 


Sample screenshots include: 
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1.1.13 The OPSEC Infrastructure of the Infamous LATAM Astaroth Banking Trojan - 


An OSINT Analysis (2023-03-24 20:51) 


@ 


vicknet@tutanota com 


[1] 


Here’s how to take it offline. 


Grab any public OSINT list and process all the domains in terms of looking for personally 
identifiable information 


Figure out what’s the personally identifiable information which is this case 
is basically a Tutanota (vicknet@tutanota.com) and a Protonmail (bestchoice- 
firstchoice@protonmail.com) email address account 


A screenshot is worth a thousand words 


Publish and disseminate all the loCs in a easy to distribute and work on form 


Approach the domain registrant’s hosting provider the let them know the good news 
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@ 


bestcholcefirstcholceg@protonmiai... 


Related loCs and C &C server domains include: 


hxxp://joaquinasocorrolisboal[.]quest 
hxxp://wanio[.]one 
hxxp://xuasou[.Jone 
hxxp://manageboard[.]cfd 
hxxp://managemind12[.]link 
hxxp://managemodel12[.]one 
hxxp://acciolddehol[.]yachts 
hxxp://administrativomail[.]top 
hxxp://administra12[.Jone 
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hxxp://corporatedb12[.]one 
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hxxp://corporatevip12[.]mom 
hxxp://counselone12[.]one 
hxxp://counselwise12[.]cfd 
hxxp://courtgranted[.Jone 
hxxp://courtordered[.]mom 
hxxp://directorial12[. ]link 
hxxp://directorlaw12[.]cfd 
hxxp://executivexyz[.]cfd 
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hxxp://executiviol2[.]mom 
hxxp://executivu12[.Jone 
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hxxp://escriturario[.]us 
hxxp://financialbom[.]us 
hxxp://masteroso[.]us 
hxxp://sistemaonpipe[.]cloud 
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hxxp://ceywu[.]one 
hxxp://dexoyful[.Jone 
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hxxp://viniciuseauroraadvocaciame[.]xyz 
hxxp://evelynediegobuffetitdal[. Jlol 
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hxxp://ingressosonline[.]pics 
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hxxp://ingressosonline[.]quest 
hxxp://insoozyobil.]cfd 
hxxp://kenzikun[.]sbs 
hxxp://kenziovskil.]top 
hxxp://maggiedesu[.]top 
hxxp://mrjbtielogh[.]top 
hxxp://nbiericbdhl[.]top 
hxxp://adannouil[.]Jone 
hxxp://barakirond[.lone 
hxxp://finrandir[.Jone 
hxxp://insidiousmann[.]sbs 
hxxp://insidiousson[.]sbs 
hxxp://insidioustrom[.]sbs 
hxxp://insidiousxie[.]cfd 
hxxp://insoocucus[.]cfd 
hxxp://empresacompetitival.]cfd 
hxxp://empresainovadora|[. ]buzz 
hxxp://gestaoeficiente[.]shop 
hxxp://inovacaonegocio[.]cyou 
hxxp://investimentoestrategico[.]cyou 
hxxp://planoempresarial[.]Jshop 
hxxp://publicidadeeficiente[.]buzz 
hxxp://botoxcapilar[.]makeup 
hxxp://botoxlabial[.] makeup 
hxxp://brsazzinoonline[.]makeup 
hxxp://cabeloscacheados[.]makeup 
hxxp://cabeloslisos[.]makeup 
hxxp://kindly[.]rest 
hxxp://votho[.]cyou 
hxxp://evenly[.]rest 
hxxp://pluti[.]cyou 
hxxp://fondly[.]Jcyou 
hxxp://supplysuccess[. ]best 
hxxp://venturevision[.]online 
hxxp://allianceadvantage[.]best 
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hxxp://oqzxtzpjagh[.]buzz 
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hxxp://modrickbustersmith[.]com 
hxxp://xburyate2017[.]Jcom 
hxxp://yorksmecanix[.]com 
hxxp://matireuaubig[.]Jcom 
hxxp://marquimtruster[.]com 
hxxp://ghfbvhbnjbhttyj[.]hair 
hxxp://ghfovhbnjbhttyj[.]homes 
hxxp://ghfbvhbnjbhttyj[.] makeup 
hxxp://ghfovhbnjbhttyj[.]mom 
hxxp://ghfovhbnjbhttyj[.]pics 
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hxxp://legitimoseletrados[.]us 
hxxp://notavell[.]us 
hxxp://rroantoche[.]us 
hxxp://kantianoskantistas[.]us 
hxxp://decrescimento[.]us 
hxxp://birrentobisbilhoteiro[.]us 
hxxp://vulgares[.]us 
hxxp://paracrisede[.]us 
hxxp://zoados[.]us 
hxxp://umexoficialdamarinha[.]us 
hxxp://desapontarosicms[.]us 
hxxp://depolitico[.]us 
hxxp://quecostumal[.]us 
hxxp://temexercido[.]us 
hxxp://debitcoinnesta[.]us 
hxxp://obotafogose[.]us 
hxxp://decenteassecla[.]us 
hxxp://derrotouovasco[.]us 
hxxp://toroerisonesufoco[.]us 
hxxp://dentrodosdetalhes[.]us 
hxxp://decondicoes[.]us 
hxxp://oinvestimento[.]us 
hxxp://comosvilaos[.]us 
hxxp://ecadavezmais[.]us 
hxxp://altashistoricas[.]Jus 


hxxp://americanothenewyork[.]us 
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hxxp://serelepesereno[.]us 
hxxp://omaterialjornalistico[.]us 
hxxp://umprojeto[. ]us 
hxxp://conformeastarifas[.]us 
hxxp://alegreagressivo[.]us 
hxxp://forampresosem[.]us 
hxxp://kepleriano[.]Jus 
hxxp://tvcomumso[. ]us 
hxxp://feitopelo[.]us 
hxxp://plutoturbos[.]us 
hxxp://deveatingir[.]us 
hxxp://fundoimobiliario[.Jus 
hxxp://sobreaenergial[.]us 
hxxp://oespiaoeaesposal[.]us 
hxxp://documentados[.]us 
hxxp://ningha[.]us 
hxxp://dossubmarinos[.]us 
hxxp://maiorespatamares[.]us 
hxxp://manndrytwigar[.]us 
hxxp://sabemosque[.]us 
hxxp://abuletangles[.]us 
hxxp://scotilhaacal.]Jus 
hxxp://laroesso[.]us 
hxxp://eleiraatins[.]us 
hxxp://eninospinho[.]us 
hxxp://assuasgarras[.]us 
hxxp://foiaprovado[.]us 
hxxp://domercado[.]us 
hxxp://atingindoos[.]us 
hxxp://documentossobre[.]us 
hxxp://omundoemalertal.]us 
hxxp://windsurfistas[.]us 
hxxp://precisoestar[.]us 
hxxp://wardceojobeo[.]us 
hxxp://comgoldeell[.]us 
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hxxp://decombustiveis[.]us 
hxxp://prioridades[.]us 
hxxp://atecnologianuclear[.]us 
hxxp://parao[.]us 
hxxp://arroganteapressado[.]us 
hxxp://seriosimpatico[.]us 
hxxp://patamar[.]us 
hxxp://atraenteatrevido[.]us 


hxxp://desgaste[.]us 


hxxp://recuperounocampeonato[.]us 


hxxp://ambiciosoamargurado[.]us 


hxxp://conhecerfrases[.]us 
hxxp://rahisenferthwerd[.]us 
hxxp://virtualteajudal[.]us 
hxxp://durantetodo[.]us 
hxxp://comandodevoz[.]us 
hxxp://extremamentecaras[.]us 
hxxp://noradargloball[.]us 
hxxp://produtosdarecord[.]us 
hxxp://cacetaregregias[.]us 
hxxp://quedanaatividade[.]us 
hxxp://precedidodeumal[.]us 
hxxp://eletricasao[.]us 
hxxp://bombombastico[.]us 
hxxp://nobrasilopais[.]us 
hxxp://naoeramrivais[.]us 
hxxp://werdtoan[.]us 
hxxp://leiadocs[.]us 
hxxp://dependesmaleitas[.]us 
hxxp://inflacaonos[.]us 
hxxp://dizmidia[.]us 
hxxp://atingemaior[.]us 
hxxp://anunciouaapreensao[.]us 
hxxp://dopreco[.]us 
hxxp://amadoaltruista[.]us 
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hxxp://saibacomoaassistente[.]us 
hxxp://empresariale[.]us 
hxxp://seujornalismo[.]us 
hxxp://emetenteebado[.]us 
hxxp://sensacionalsensato[.]us 
hxxp://porcausa[.]us 
hxxp://assertivoatencioso[.]us 
hxxp://xardosone[.]us 
hxxp://semprecapacitado[.]us 
hxxp://coisasvibrantes[.]us 
hxxp://ubesena[.]us 
hxxp://inflacionarias[.]us 
hxxp://cassenteinfernoc[.]us 
hxxp://bcopeirodefecar[.]us 
hxxp://agentealvejaral[.]us 
hxxp://fmadeixaespessof[.]us 
hxxp://earsenaldaremose[.]us 
hxxp://pressao[.]us 
hxxp://plutofortunax[.]us 
hxxp://largoleal[.Jus 
hxxp://justiceirojusto[.]us 
hxxp://ledolegall[.Jus 
hxxp://kardecistakepleriano[.]us 
hxxp://loucolouvavell[.]us 
hxxp://levesliberais[.Jus 
hxxp://licitolider[.Jus 
hxxp://luxuososlivres[.]us 
hxxp://xabouqueiro[.]us 
hxxp://amiones[.]us 
hxxp://ethelealrah[.]us 
hxxp://ceoanwineo[.]us 
hxxp://useing[.]us 
hxxp://usedroneschool[.]us 
hxxp://porissobasta[.]Jus 
hxxp://neschoolapp[.]us 
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hxxp://rning[.]Jus 
hxxp://preguicosoprepotente[.]us 
hxxp://pacatopaciente[.]us 
hxxp://perseverantepersistente[.]us 
hxxp://perspicazespessimistas[.]us 
hxxp://perfeccionistaperfeito[.]Jus 
hxxp://preocupadopreparado|[.]us 
hxxp://presuncosoprestativo[.]us 
hxxp://prevenidoprimoroso[.]us 
hxxp://prosperoprotetor[.]us 
hxxp://problematicoprodutivo[.]us 
hxxp://piedosospioneiros[.]us 
hxxp://passivopequeno[.]us 
hxxp://mitcargifuchris[.]us 
hxxp://sempreativo[.]us 
hxxp://ajaxtime[.]us 
hxxp://bemhumoradobemintencionado[.]us 
hxxp://livrelindo[.]us 
hxxp://trylearning[.]us 
hxxp://demaquinasdemineracao[.]us 
hxxp://saoluismal[.]us 
hxxp://nocastelaoem[.]us 
hxxp://osegundotempo[.]us 
hxxp://weberiano[.]us 
hxxp://thezens[.]Jus 
hxxp://compontoso[.]us 
hxxp://rahrodrytjohn[.]us 
hxxp://desdecoloca[.]us 
hxxp://inflacaomostra[.]us 
hxxp://baldarisencome[.]us 
hxxp://constantede[.]us 
hxxp://outubrosegundo[.]us 
hxxp://naqualidade[.]us 
hxxp://brandsonthashal[.]us 


hxxp://emissaodecotas[.]us 
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hxxp://isensanmitmond[.]us 
hxxp://naoeolocall[.]us 
hxxp://tercafeirasob[.]us 
hxxp://fornecimento[.]us 
hxxp://avorazes[.]us 
hxxp://pornanoite[.]us 
hxxp://tiveremouteiro[.]us 
hxxp://paraaproveitar[.]us 
hxxp://schoolpe[.]us 
hxxp://acusacaodefurto[.]us 
hxxp://almejamfuleiras[.]us 
hxxp://deenergiaalem[.]us 
hxxp://fomentasmacerar[.]us 
hxxp://aalta[.Jus 
hxxp://meninovingativo[.]us 
hxxp://oprocessode[.]us 
hxxp://hereisumrob[.]us 
hxxp://apenasnobrasil[.Jus 
hxxp://anualdeveser[.]us 
hxxp://altadejuros[.]us 
hxxp://asestrategias|[.]us 
Related loCs and C &C server domains: 
hxxp://roverdoneover[.]us 
hxxp://traducoesdedocumentos[.]us 
hxxp://topostay[.]us 
hxxp://thecriminalmind[.]us 
hxxp://thegreenfund[.]us 
hxxp://welcomecorp[.]Jus 
hxxp://visiontrans[.]us 
hxxp://williamscleaning[.]us 
hxxp://muchmoremoneyl.]us 
hxxp://newsbridge[.]us 
hxxp://myopinionmatters[.]us 
hxxp://portlandfrredum[.]us 
hxxp://pointman[.]Jus 
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hxxp://raingardens[.]us 
hxxp://northwestvegfest[.]us 
hxxp://psychicconnection[.]us 
hxxp://densutefit[.Jus 
hxxp://mypersonalwebcams[.]us 
hxxp://mustevents[.]us 
hxxp://rebellebeauty[.]us 
hxxp://neworleansescort[.]us 
hxxp://teamhilton[.]us 
hxxp://pearlclo[.]Jus 
hxxp://seniorresources[.]us 
hxxp://politicu[.]us 
hxxp://wordfm[.]us 
hxxp://ouronlinel[.]Jus 
hxxp://technologyecho[.]us 
hxxp://nathalagueral[.]us 
hxxp://stimulusupdate[.]us 
hxxp://traducaodedocumentos[.]us 
hxxp://trimed[.]us 
hxxp://pkassit[.]us 
hxxp://valuegranite[.]us 
hxxp://safestepshowers[.]us 
hxxp://propersun[.]us 
hxxp://vignati[.]us 
hxxp://testwhether[.]us 
hxxp://waterandfiredamagerestoration[.]us 
hxxp://superfoodworld[.]us 
hxxp://texasturf[.Jus 
hxxp://sunsetinnsuitesseward[.]us 
hxxp://theappcollective[.]us 
hxxp://shopxclusive[.]us 
hxxp://szresearch[.]us 
hxxp://uselu[.]us 
hxxp://scrapfriends[.]us 


hxxp://ruxtnation[.]us 
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hxxp://sustainablechoices[.]us 
hxxp://thepcl[.Jus 
hxxp://thefishguy[.]us 
hxxp://magazinesop[.]us 
hxxp://lickingountyohio[.]us 
hxxp://transcendentalfilmstudios[.]us 
hxxp://fortve[.Jus 
hxxp://cypherock[.]us 
hxxp://duvetica[.Jus 
hxxp://gassingamerical[.]us 
hxxp://drdentall[.]us 
hxxp://crstalmavensltd[.]us 
hxxp://bpstech[.]us 
hxxp://flightbookingexpert[.]us 
hxxp://brendansmith[.]Jus 
hxxp://collegeathleterecruiting[.]us 
hxxp://frontlinerestoration[.]us 
hxxp://fenesse[.]us 
hxxp://finesss[.]us 
hxxp://healththefxforms[.]us 
hxxp://balloonexpress[.]us 
hxxp://adebeatz[.]us 
hxxp://kingstreeranch[.]us 
hxxp://barcley[.]us 
hxxp://bigpawslargebreedrescue[.]us 
hxxp://inkdesign[.]us 
hxxp://bcarroll[.]us 
hxxp://apassist[.]us 
hxxp://ambassadorbuilders[.]us 
hxxp://justtryingtosurvivel[.]Jus 
hxxp://biani[.Jus 
hxxp://hokashops[.]us 
hxxp://michealsons[.]us 
hxxp://mesastamps[.]us 
hxxp://mardigrasapperall.]us 
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hxxp://lovefinder[.]us 
hxxp://lionspath[.]us 


hxxp://magicmatters[.]us 


hxxp://allnationscommunitychurch[. ]us 


hxxp://amprowide[.]us 
hxxp://andesflowers[.]us 
hxxp://cyberspark[.]us 
hxxp://cinqueterre[.]us 
hxxp://clouddriven[.]Jus 
hxxp://bowtietransportation[.]us 
hxxp://brimbleclothing[.Jus 
hxxp://dewaldroofing[.]us 
hxxp://assetscast[.]us 
hxxp://cucinaventimountainview[.]us 
hxxp://certirsa[.]Jus 
hxxp://graphictwear[.]us 
hxxp://evergreenbaptist[.]us 
hxxp://iatlantic[.]us 
hxxp://divineappointments[.]us 
hxxp://flightoftheeagle[.Jus 
hxxp://investax[.]Jus 
hxxp://dulastrade[.]us 
hxxp://floridasupport[.]us 
hxxp://dirtypictures[.]us 
hxxp://digitalartmasters[.]us 
hxxp://esandx[.]us 
hxxp://forslink[.Jus 
hxxp://nhomemailers[.]us 
hxxp://fgroundrpowergenrator[.]us 
hxxp://hivelife[.Jus 
hxxp://laststock[.]us 
hxxp://letterperfectinc[.Jus 
hxxp://marinecuisine[.]us 
hxxp://loveheartnow|[.]us 


hxxp://meatsandwich[.]us 
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hxxp://lovingu[.]us 
hxxp://makethewebwork[.]us 
hxxp://lousyfers[.]us 
hxxp://maldivesembassy[.]us 
hxxp://usremedyanchor[.]us 
hxxp://afriquejmarbitrage[.]us 
hxxp://assetprotect[.]Jus 
hxxp://aspireit[.]us 
hxxp://atvgames[.]us 
hxxp://americastatenationals[.]us 
hxxp://herocmetics[.]us 
hxxp://loteriade[.]Jus 
hxxp://decksbetter[.]us 
hxxp://blingdings[.]us 
hxxp://movingsigns[.]us 
hxxp://kingjordan[.]Jus 
hxxp://curlcare[.]us 
hxxp://brevrdclerk[.]us 
hxxp://passisp[.]us 
hxxp://millenniumhealthzoom[.]us 
hxxp://petslvs[.]us 
hxxp://trendingfilms[.]us 
hxxp://bylobster[.]us 
hxxp://socialexchanger[.]us 
hxxp://brandedboards[.]us 
hxxp://passise[.]us 
hxxp://stellaniagara[.]us 
hxxp://laserturntable[.]Jus 
hxxp://verdansk[.]us 
hxxp://annoor[.]us 
hxxp://fishercustomerservice[.]us 
hxxp://directinteriors[.]us 
hxxp://usfamilywatchdog[.]us 
hxxp://pswad[.]us 
hxxp://elemetaldesign[.]us 
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hxxp://cccount[.]us 
hxxp://flowerstog[.]us 
hxxp://crimsonsun[.]us 
hxxp://discounthdtv[.]us 
hxxp://greenvommunications[.]us 
hxxp://ajourlingerie[.]us 
hxxp://customersupportnumber[.]us 
hxxp://genuineuatoparts[.]us 
hxxp://doglicenss[.]us 
hxxp://plumberguyinsuranc[.]us 
hxxp://moomooleatherworks[.]us 
hxxp://joeshandymanservice[.]us 
hxxp://flightcrewtraining[.]us 
hxxp://fediet[.]us 
hxxp://runarealbiz[.]us 
hxxp://truckconsoll[.Jus 
hxxp://bbcicecream[.]us 
hxxp://wilcome[.]us 
hxxp://actury[.]us 
hxxp://thecolouredsection[.]us 
hxxp://neptuneretailsolutionszoom[.]us 
hxxp://toptipsoffice[.]us 
hxxp://unitedindustries[.]us 
hxxp://moranatias[.]us 
hxxp://systemwireless[.]us 
hxxp://resianger[.]us 
hxxp://lastbof[.]us 
hxxp://modelamerical[.]us 
hxxp://humphreysmarket[.]us 
hxxp://mailitnmore[.]Jus 
hxxp://abreakingnews[.]us 
hxxp://alleghenycounts[.]us 
hxxp://mattlanter[.]us 
hxxp://lilycrowaesthetic[.]us 


hxxp://comstockhomebuildingcompaniesinc[.]us 
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hxxp://lbmgmusic[.]us 
hxxp://vestlihouse[.]us 
hxxp://myfirststep[.]us 
hxxp://northfacewomensjackets[.]us 
hxxp://oversupply[.]us 
hxxp://oakleysales[.]Jus 
hxxp://redskullserver[.Jus 
hxxp://rangeamerical[.]us 
hxxp://nyshealthdepartment[.]Jus 
hxxp://pairings[.]us 
hxxp://passisst[.]us 
hxxp://paymeonline[.]us 
hxxp://rockethomebuyers[.]us 
hxxp://roserra[.]us 
hxxp://rootcellar[.Jus 
hxxp://uniteam[.]us 
hxxp://wholesalebizjerseyscheapto[.]us 
hxxp://unitedflowers[.]us 
hxxp://wellecome[.]us 
hxxp://unitedhomef[.]us 
hxxp://wolcome|[.]us 
hxxp://yahwehgather[.]us 
hxxp://sofacovers[.]us 
hxxp://streetsforall[.Jus 
hxxp://scintillate[.]us 
hxxp://shapemasters[.]us 
hxxp://saigonservices[.]us 
hxxp://statsource[.]us 
hxxp://technicalsolution[.]us 
hxxp://teachertechl[.]us 
hxxp://bestpartmentrentals[.]us 
hxxp://atrlink[.]us 
hxxp://authenticindian[.]us 
hxxp://apmportland[.]us 
hxxp://bsupply[.Jus 
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hxxp://adamcjkelin[.]us 
hxxp://artogal[.]Jus 
hxxp://atlanticwaters[.]us 
hxxp://bydesignwoodworks[.]us 
hxxp://derekevans[.]us 
hxxp://coolmall[.Jus 
hxxp://conferencial.]Jus 
hxxp://fantastictees[.]us 
hxxp://fanaticsoutlets[.]us 
hxxp://forntlinebdibetesil[.]us 
hxxp://flowcon[.]us 
hxxp://healtheforms[.]us 
hxxp://intenseit[.]us 
hxxp://healthclip[.]us 
hxxp://hollyspringsms[.]us 


hxxp://hisandhersdreamcollection[.]us 


hxxp://heavensgates[.]us 
hxxp://healthyankee[.]us 
hxxp://journeylife[.]us 
hxxp://minebo[.]us 
hxxp://jetcar[.]Jus 
hxxp://labrokers[.]us 
hxxp://kmddesigns[.]us 
hxxp://pamperedpetspa[.]us 
hxxp://passit[.]Jus 
hxxp://pkassis[.]us 
hxxp://newgames[.]us 
hxxp://pessist[.]us 
hxxp://pilgrimsalliance[.]us 
hxxp://shand[.]us 
hxxp://uvmedicall[.]Jus 
hxxp://usschools[.]us 
hxxp://spicehut[.]us 
hxxp://castleragdolls[.]Jus 


hxxp://cheapaccessories[.]us 
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hxxp://acidreams[.]us 
hxxp://jmyerswaterservicesinc[.]us 
hxxp://custommug[.]us 
hxxp://jrens[.]us 
hxxp://claireandmatthew[.]us 
hxxp://nutssoftware[.]us 
hxxp://nationalpawnbrokers[.]us 
hxxp://pitmadter[.]us 
hxxp://safesteoshower[.]us 
hxxp://katio[.]us 
hxxp://platewrap[.]us 
hxxp://nextjenhomesolutions[.]us 
hxxp://mentalhealthisheath[.]us 
hxxp://resoreher[.]us 
hxxp://rentalapps[.]us 
hxxp://ramentalkk[.]us 
hxxp://monroecountysherrifsoffice[.]us 
hxxp://mcmanamons[. ]us 
hxxp://rillsong[.]us 
hxxp://opticaloverstock[.]us 
hxxp://mdmesicalgroup[.]us 
hxxp://penisenhancementpills[.]us 
hxxp://personalizedjerseystore[.]us 
hxxp://townleader[.]us 
hxxp://wellppath[.]us 
hxxp://tsuminil[.]us 
hxxp://yourcarourdriver[.]us 
hxxp://shapark[.]us 
hxxp://shanoess[.]us 
hxxp://tropicomotelglendale[.]us 
hxxp://westandersonwater[.]us 
hxxp://visionstax[.]us 
hxxp://smokestick[.]us 
hxxp://cumberlandtrac[.]us 
hxxp://premiumtelephonedirectories[.]us 
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hxxp://kristenstewart[.]us 
hxxp://airtechheating[.]us 
hxxp://theraptorsshop[.]us 
hxxp://doctorscrub[.]us 
hxxp://petgratis[.]us 
hxxp://thewaytv[.]us 
hxxp://reliablenhlstarsjersey[.]us 
hxxp://politicatees[.Jus 
hxxp://antyspy[.]us 
hxxp://douglascountynv[.]us 
hxxp://buildingblockspreschool[.]us 
hxxp://royalleads[.]us 
hxxp://powersubmitpro[.]us 
hxxp://carlosmachado|[.]us 
hxxp://anatomychartee[.]us 
hxxp://emaillist[.]us 
hxxp://chinatu[.]us 
hxxp://cinemedicscny[.]us 
hxxp://doersmindset[.]us 
hxxp://designedalliance[.]us 
hxxp://enewsletter[.]us 
hxxp://arrayofthings[.]us 
hxxp://armstronglandscaping[.]us 
hxxp://cheapnfljerseyschinabiz[.]us 
hxxp://calvarychristianschooll[.]us 
hxxp://congregationemanuel[.]us 
hxxp://customlighters[.]us 
hxxp://derekwebster[.]us 
hxxp://arizonahomefinder[.]us 
hxxp://esaca[.]us 
hxxp://etsales[.Jus 
hxxp://fuelalternatives[.]us 
hxxp://gingero[.]us 
hxxp://naresatinbuy[.]Jus 


hxxp://finerpoints[.]us 
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hxxp://forbesdc[.Jus 
hxxp://haltforeclosure[.]us 
hxxp://houselia[.Jus 
hxxp://immigrationattorneycalifornia[.]us 
hxxp://jobagent[.]us 
hxxp://knolls[.Jus 
hxxp://milion[.]Jus 
hxxp://massageart[.]us 
hxxp://magnoliainsurance[.]us 
hxxp://markstuart[.]us 
hxxp://liveops[.]us 
hxxp://monclerjacket[.]us 
hxxp://movingexperts[.]us 
hxxp://orderthegypsypoet[.]us 
hxxp://okmall[.]us 
hxxp://perezroofing[.]us 
hxxp://saharabuilders[.]us 
hxxp://seattlefeb[.]us 
hxxp://resetchurch[.]us 
hxxp://preschoolteacherjobs[.]us 
hxxp://salonrenter[.]us 
hxxp://philakoreanmemoriall.Jus 
hxxp://scooternews[.]us 
hxxp://rossonline[.]us 
hxxp://playthegameoflife[.]us 
hxxp://margus[.]us 
hxxp://healworldwide[.]us 
hxxp://newhomebostonterrier[.]us 
hxxp://retaininternationall[.]us 
hxxp://rapaonline[.]us 
hxxp://naturescanvas[.]us 
hxxp://bringmeback[.]Jus 
hxxp://pourchet[.]us 
hxxp://cobbpennyminted[.]us 
hxxp://icebreakers[.]us 
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hxxp://exchangeplace[.]us 
hxxp://airbo[.]us 
hxxp://nyasianchannel[.]Jus 
hxxp://shoreacres[.]us 
hxxp://earthchurch[.]Jus 
hxxp://orlenfound[.]us 
hxxp://rdequine[.]Jus 
hxxp://hawgsanddawg[.]us 


hxxp://superiorprinting[.]us 


hxxp://randomactofmendez[.]us 
hxxp://roselynecleaningservice[.]us 


hxxp://proquickbooksupport[.]us 


hxxp://forniteoffers[.]us 
hxxp://nashforcash[.]us 
hxxp://securenetworks[.]us 
hxxp://catalystclub[.]us 


hxxp://cariandmikel[.]us 


hxxp://disenoweblosangeles[.]us 


hxxp://gravitybackdrops[.]us 
hxxp://dallaswebdesign[.]us 
hxxp://robertandnicole[.]us 
hxxp://amorek[.]us 
hxxp://allfiles[.]us 
hxxp://amandabell[.Jus 
hxxp://affordablefashions[.]us 
hxxp://artforms[.]us 
hxxp://brickandwood[.]us 
hxxp://cipsmarketing[.]us 
hxxp://chanelpromotions[.]us 
hxxp://brazander[.]Jus 
hxxp://btanywhere[.]us 
hxxp://cityowestminster[.]us 
hxxp://combatveterans[.]us 
hxxp://connectinghair[.]us 


hxxp://countyroadcountry[.]us 
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hxxp://fearlessangles[.]Jus 
hxxp://diamonchic[.]us 
hxxp://feartofreedom[.]us 
hxxp://evanwinter[.]us 
hxxp://digitalguide[.]us 
hxxp://diater[.]us 
hxxp://digitaldirections[.Jus 
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hxxp://buysleepingpillsonline[.]us 
hxxp://designersdigest[.]us 
hxxp://finerliving[.Jus 
hxxp://flanative[.]us 
hxxp://finearttransport[.]Jus 
hxxp://forpublicuse[.]Jus 
hxxp://freedomshirts[.]us 
hxxp://mkareal[.]us 
hxxp://monkeyfilms[.]us 
hxxp://moodyblusr[.]us 
hxxp://mountprospectweather[.]us 
hxxp://musicaddictive[.]us 
hxxp://paypamerceplatform[.]us 
hxxp://natashamurray[.]us 
hxxp://oemstore[.]us 
hxxp://wowcenter[.]us 
hxxp://trimetrix[.Jus 
hxxp://ultrabrainfestation[.]us 
hxxp://thesowershouse[.]us 
hxxp://theoutsideclub[.]us 
hxxp://contratistas[.]Jus 
hxxp://greencoffeeextract[.]us 
hxxp://giftsfree[.Jus 
hxxp://goldinge[.Jus 
hxxp://sgbeverage[.]us 
hxxp://whattheworldneeds[.]us 
hxxp://hikingdaypacks[.]us 
hxxp://healhub[.]Jus 
hxxp://winterblankets[.]us 


hxxp://heartpathwellness[.]us 
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hxxp://healthinsuranceforall[.Jus 
hxxp://hhimaging[.]us 
hxxp://kaalee[.Jus 
hxxp://pureculture[.Jus 
hxxp://kkandc[.]us 
hxxp://graduationdecoractions[.]us 
hxxp://hotchillies[.]us 
hxxp://hyphenation[.]Jus 
hxxp://newjournall[.]us 
hxxp://novacorporation[.]us 
hxxp://jakebartley[.Jus 
hxxp://zenithquestintl[.Jus 
hxxp://iphonulo[.]us 
hxxp://iadvancenowusal[.]us 
hxxp://jempson[.]us 
hxxp://southcarolinafootball[.]us 
hxxp://installar[.]us 
hxxp://krishnanutley[.]us 
hxxp://mihanil[.Jus 
hxxp://getsyllab[.]Jus 
hxxp://handsonhealth[. Jus 
hxxp://jessiandtim[.Jus 
hxxp://goldenhoneysmcsc[.]us 
hxxp://healthyacaiberry[.]us 
hxxp://filix[.Jus 
hxxp://findwine[.]Jus 
hxxp://functionalfitnessfl[.]us 
hxxp://kardinaalimunal[.]us 
hxxp://keilelectric[.]us 
hxxp://westfieldseo[.]us 
hxxp://freexboxandplaystationmoney|[.]us 
hxxp://fdkautosaleinc[.]us 
hxxp://lashr[.]us 
hxxp://knightapparel[.]Jus 
hxxp://eacct[.]us 
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hxxp://lifestyleconsultant[.]Jus 
hxxp://levetech[.]us 
hxxp://Itcdoctordeals[.]us 
hxxp://dirtydreams[.]us 
hxxp://herioc[.]us 
hxxp://worshipwithyou[.]us 
hxxp://vegande[.]us 
hxxp://wrightsheatingandairval[.]us 
hxxp://dsahealthcar[.]us 
hxxp://healtub[.]us 
hxxp://footballupdates[.]Jus 
hxxp://forumwars[. ]us 
hxxp://stardustdancers[.]us 
hxxp://unitedseniorservices[.]us 
hxxp://cuyahogatreasury[.]us 
hxxp://gbliagenc[.]us 
hxxp://fishingtackles[.]us 
hxxp://evolvedin[.]us 
hxxp://tintguy[.Jus 
hxxp://getcableservice[.]us 
hxxp://nappeandsons[.]us 
hxxp://ouerasures[.]us 
hxxp://officialpackersshop[.]us 
hxxp://unitedshelter[.]us 
hxxp://wellpathhealth[.]us 
hxxp://ringforcfo[.Jus 
hxxp://stont[.]us 
hxxp://cityofrefugeministries[.]us 
hxxp://beachsidepoolservice[.]us 
hxxp://truckviewer[.]us 
hxxp://afterschoolclubs[.]us 
hxxp://freedombands[.]us 
hxxp://petcollect[.Jus 
hxxp://nealthhappenseverywhere[.]us 


hxxp://tinylike[.]us 
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hxxp://tillsfashiontrends[.]us 
hxxp://apointofflight[.]us 
hxxp://abogdadeinmigracion[.]us 
hxxp://thriveinc[.Jus 
hxxp://connexusprotection[.]us 
hxxp://authenticnhljerseys[.]us 
hxxp://buffalowholesale[.]us 
hxxp://atredomaine[.]us 
hxxp://alquranacademyl[.]us 
hxxp://jacksoncountypark[.]us 
hxxp://theblackwomanisjudas[.]us 
hxxp://lunacounttnm[.]us 
hxxp://healthefaxforms[.]us 
hxxp://clickmagazine[.]us 
hxxp://doctorsaludable[.]us 
hxxp://imageshark[.]us 
hxxp://dreadfulservices[.]us 
hxxp://fragrencebuy[.]us 
hxxp://imputing[.]us 
hxxp://gamevaultcareerhunter[.]us 
hxxp://shiftgrain[.]us 
hxxp://sneakerpagel[.]us 
hxxp://sportscom[.]us 
hxxp://resellgemsfashion[.]us 
hxxp://creativik[.]us 
hxxp://entprotger[.]us 
hxxp://fortbendtx[.]us 
hxxp://selectormarketing[.]us 
hxxp://pgiver[.]Jus 
hxxp://schreyerindustries[.]us 
hxxp://fiercesports[.]us 
hxxp://samanthagarcia[.]us 
hxxp://salvatoregalliano[.]us 
hxxp://semasafyal[.]Jus 
hxxp://designbro[.]us 
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hxxp://mareagift[.]us 
hxxp://rapslion[.]us 
hxxp://thealcoholclass[.]us 
hxxp://topdigitalbrands[.]Jus 
hxxp://thewomenstore[.]us 
hxxp://thetapestry[.]us 
hxxp://brandpen[.]us 
hxxp://realestateinnovatio[.]us 
hxxp://powerhouseinc[.]us 
hxxp://triathletestore[.]us 
hxxp://autobeacon[.]us 
hxxp://elaut[.]us 
hxxp://benandmelanie[.]us 
hxxp://excar[.]us 
hxxp://globaltraveler[.]us 
hxxp://haelthinee[.]us 
hxxp://oncasure[.]us 
hxxp://onesecreminder[.]us 
hxxp://proteesun[.]us 
hxxp://salonrx[.]us 
hxxp://raulsmexicancatering[.]us 
hxxp://simmonsgroupltd[.]Jus 
hxxp://sonsofsylvia[.]us 
hxxp://vacationsfornurses[.]us 
hxxp://weddingregistryideas[.]us 
hxxp://clearcreekcountry[.]us 
hxxp://levitracheap[.]us 
hxxp://nossaman[.]us 
hxxp://benroethlisbergerjerseys[.]us 
hxxp://drjoelackerman[.]us 
hxxp://paganino[.]us 
hxxp://opcfactor[.]us 
hxxp://salonliv[.]Jus 
hxxp://solistice[.]us 


hxxp://calmair[.]us 
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hxxp://vuepoint[.]us 
hxxp://connectorlifestyle[.]us 
hxxp://supplyjerseysonline[.Jus 
hxxp://caribo[.]us 
hxxp://chinaowns[.]us 
hxxp://carzy[.Jus 
hxxp://chargermagic[.]us 
hxxp://carrub[.]us 
hxxp://chathamanglers[.]us 
hxxp://brilliantbeginnings[.]us 
hxxp://cellphonebag[.]us 
hxxp://howboutchal.]us 
hxxp://hialeahiphonerepairs[.]us 
hxxp://hipnoterapil[.]us 
hxxp://flyingweb[.]us 
hxxp://montagemedialive[.]us 
hxxp://movieforu[.]us 
hxxp://sastrainingbysysed[.]us 
hxxp://spinegym[.]us 
hxxp://surfcycle[.]us 
hxxp://thegioidotap[.]us 
hxxp://walldewil[.]us 
hxxp://datablock[.]Jus 
hxxp://ddlanselot[.]Jus 
hxxp://dcarabajal[.Jus 
hxxp://envisionretirement[.]us 
hxxp://heilandroofing[.]us 
hxxp://trts[.Jus 
hxxp://wethepeoplelegall[.]us 
hxxp://thescream[.]us 
hxxp://travelinsuranceland[.]Jus 
hxxp://westernpharmal[.]us 
hxxp://theamericanstatenationals[.]us 
hxxp://washingtonparkpolice[.]us 
hxxp://waterbury[.]us 
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hxxp://votesong[.]us 
hxxp://tomschott[.]us 
hxxp://tomsoutletstore[.]us 
hxxp://wildhood[.]Jus 
hxxp://warmonger[.]us 
hxxp://waplink[.]us 
hxxp://redwhiteandcrue[.]us 
hxxp://rapturewatch[.]us 
hxxp://realeyes[.]us 
hxxp://mysponsor[.]us 
hxxp://niagarawaterproofing[.]us 
hxxp://myascention[.]us 
hxxp://raindev[.]us 
hxxp://myrokuactivationlink[.]us 
hxxp://nnacomn[.]us 
hxxp://nolprostaff[.Jus 
hxxp://othersfirst[.]Jus 
hxxp://projectstudio[.]us 
hxxp://saratov[.]us 
hxxp://oklahomadirect[.]us 
hxxp://saltwaterspinning[.]us 
hxxp://premierehosting[.]us 
hxxp://pyranol[.Jus 
hxxp://safehandle[.]us 
hxxp://rugmerchant[.]us 
hxxp://offerdeals[.]us 
hxxp://plainvillemal[.Jus 
hxxp://rugcleaningnyc[.]us 
hxxp://rowdigital[.]us 
hxxp://qrcodesrealestate[.]us 
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hxxp://tismensclub[.]us 
hxxp://toddlerboutique[.]us 
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hxxp://simmonet[.]us 
hxxp://waterliliesforsale[.]us 
hxxp://supportservice[.]us 
hxxp://thefurniturestore[.]us 
hxxp://themotolab[.]us 
hxxp://trymaster[.]us 
hxxp://susgarden[.]us 
hxxp://websetpassword[.]us 
hxxp://theoryofevolution[.]us 
hxxp://stewartwhite[.]us 
hxxp://techamerical.]us 
hxxp://wariant[.]Jus 
hxxp://travelzwith[.]us 
hxxp://starsandstripessports[.]us 
hxxp://simard[.]us 
hxxp://showmydesk[.]us 
hxxp://tredo[.]us 
hxxp://statecollagepal[.]us 
hxxp://usedlaptopsforsale[.]us 
hxxp://tracery[.]us 
hxxp://wearenext[.]us 
hxxp://serenadetheco[.]us 
hxxp://tophouseusal[.]us 
hxxp://shannonrenee[.]us 
hxxp://thedoorman[.]us 
hxxp://atip[.Jus 
hxxp://colormax[.]us 
hxxp://aeriesauhsd[.]us 
hxxp://bakeryhosting[.]us 
hxxp://andersongroup[.]us 
hxxp://biomedsales[.]us 
hxxp://abreaction[.]us 
hxxp://accredish[.]Jus 
hxxp://aaronthompson[.]us 
hxxp://benchwarmers[.]us 
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hxxp://allsql[.Jus 
hxxp://bannerbuz[.]us 
hxxp://cellis[.]us 
hxxp://answeronline[.]us 
hxxp://accounton[.]us 
hxxp://aquafinabottlewater[.]us 
hxxp://adventurland[.]us 
hxxp://besteduloan[.]us 
hxxp://ajshopil[.]Jus 
hxxp://allitsolution[.]us 
hxxp://camerastrap[.]us 
hxxp://annuall[.Jus 
hxxp://carusokarrwedding[.]us 
hxxp://academypro[.]us 
hxxp://charlenecooperhamiltonrealtor[.]us 
hxxp://authentees[.]us 
hxxp://bassearphones[.]us 
hxxp://arlintonhousing[.]us 
hxxp://alpharecruiters[.]us 
hxxp://americanmachinegarage[.]us 
hxxp://guist[.]us 
hxxp://ctureview[.]us 
hxxp://confederateflag[.]us 
hxxp://cxpert[.]us 
hxxp://cubansinamerics[.]us 
hxxp://enternall[.Jus 
hxxp://ellenyoung[.]us 
hxxp://fepbluedentall.]Jus 
hxxp://condiment[.]us 
hxxp://denturfit[.]us 
hxxp://diamondetails[.]us 
hxxp://gwiegand[.]us 
hxxp://fortherealm[.]Jus 
hxxp://gwall[.]us 
hxxp://haringvliet[.Jus 
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hxxp://dealoffer[.]us 
hxxp://goyaproductions[.]us 
hxxp://gratomic[.]Jus 
hxxp://designingtalent[.]us 
hxxp://dealsheaven[.]us 
hxxp://eurodent[.]us 
hxxp://dalemedial[.]us 
hxxp://neadsupeducationalconsulting[.]us 
hxxp://fireiseveryonesfight[.]us 
hxxp://cybercleaner[.]us 
hxxp://healthefxfroms[.]us 
hxxp://computerbase[.]us 
hxxp://foldingchairsandtables[.]us 
hxxp://eggshellcafe[.Jus 
hxxp://foldablesolar[.Jus 
hxxp://fcindianal.]us 
hxxp://drdavidcohen[.]us 
hxxp://diablosrojos[.]us 
hxxp://cotyofvancouver[.]us 
hxxp://cardinalsproshop[.]us 
hxxp://crossjerseys[.]us 
hxxp://cristalpalaceresort[.]us 
hxxp://davesmusic[.]us 
hxxp://herbalizestore[.]Jus 
hxxp://mattomer[.]us 
hxxp://mankfull[.]us 
hxxp://tearomal[.]Jus 
hxxp://alliteampsycleuscas[.]us 
hxxp://minvestments[.]us 
hxxp://chamathbtc[.]Jus 
hxxp://catct[.]us 
hxxp://chanyeoll[.]us 
hxxp://technologysustain[.]us 
hxxp://casamariposa[.]Jus 
hxxp://protechtio[.]us 
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hxxp://hiredhands[.]us 
hxxp://nissanleaf[.]us 
hxxp://bookpeddler[.Jus 
hxxp://bmisupply[.Jus 
hxxp://oosterhousewedding|[.]us 
hxxp://betterlandlord[.Jus 
hxxp://blackliver[.]Jus 
hxxp://bettea[.]us 
hxxp://carsandtrucks[.]us 
hxxp://daleso[.]us 
hxxp://besttreadmillforhomes[.]us 
hxxp://digitalantenna[.]us 
hxxp://perirenall[.]us 
hxxp://pathfindernetwork[.]us 
hxxp://behelp[.]us 
hxxp://bellacinos[.]us 
hxxp://pdparty[.]us 
hxxp://peturo[.]us 
hxxp://northdome[.]us 
hxxp://powerchic[.]us 
hxxp://resistancepac[.]us 
hxxp://poweringroundenergy[.]us 
hxxp://pressuastreetwear[.]us 
hxxp://lophealth[. Jus 
hxxp://bagklan[.]us 
hxxp://qanmshop[. Jus 
hxxp://pyrometer[.]us 
hxxp://aquawritings[.]us 
hxxp://artistrycouture[.]us 
hxxp://austincitylimits[.]Jus 
hxxp://reactiondesign[.]us 
hxxp://atlantausedcars[.]us 
hxxp://interviu[.]us 
hxxp://steriluv[.]Jus 


hxxp://ankorsafe[.]us 
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hxxp://detailworks[.]us 
hxxp://pressurebeauty[.]us 
hxxp://allaboutlouisbyabizia[.]us 
hxxp://seawindsun[.]us 
hxxp://allthatjazzdance[.]us 
hxxp://airportassociates[.]us 
hxxp://aislingfarm[.Jus 
hxxp://amgtobacco[.]us 
hxxp://alterationsmaster[.]us 
hxxp://alltruenaturall[.]us 
hxxp://amateursare[.]us 
hxxp://americanpatch[.]us 
hxxp://ambianceme[.]us 
hxxp://alpacafarm[.]us 
hxxp://anonsocks[.]Jus 
hxxp://mightykite[.Jus 
hxxp://sentiential[.]Jus 
hxxp://skner[.]us 
hxxp://sensiblerecycling[.]us 
hxxp://shopsaints[.]us 
hxxp://aggielandpowerwashing[.]us 
hxxp://agapejracademy[.]us 
hxxp://sincerelyanna[.]us 
hxxp://adventurescuba[.]us 
hxxp://adamsmedial[.]us 
hxxp://advancedai[.]us 
hxxp://supericy[.]us 
hxxp://trendygems[.]us 
hxxp://storearc[.]us 
hxxp://stayfact[.]us 
hxxp://adamsco[.]us 
hxxp://adminjobs[.]us 
hxxp://aerolinks[.]us 
hxxp://sxriver[.]us 
hxxp://sturgisrally[.Jus 
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hxxp://zinglucy[.]us 
hxxp://accesspasswordrecovery|[.]us 
hxxp://stabletransit[.]us 
hxxp://thebestfit[.]us 
hxxp://drainbot[.Jus 
hxxp://thenerdcave[.]us 
hxxp://timache[.]us 
hxxp://toroscriar[.]us 
hxxp://devendrapatkil[.Jus 
hxxp://dayistoday[.]us 
hxxp://veranohome[.]us 


hxxp://wealthgenerator[.]us 


hxxp://whatarebestmortgageloans[.]us 


hxxp://wellnessconnections[.]us 
hxxp://womenonboards[.]us 
hxxp://hassy[.]Jus 
hxxp://datacesst[.]us 
hxxp://remediosnaturale[.]us 
hxxp://improveyourhealth[.]us 
hxxp://summrbleeding[.]us 
hxxp://singfamo[.]us 
hxxp://hmanorlodge[.]Jus 
hxxp://edragons[.]us 
hxxp://esscore[.]us 
hxxp://cooltoast[.]us 
hxxp://familytraditions[.]us 
hxxp://drimportir[.]us 
hxxp://livecometdatal[.]us 
hxxp://qnifzymwaj[.]us 
hxxp://streamplay[.]us 
hxxp://swiftsupport[.]us 
hxxp://superplumbingfix[.]us 
hxxp://summermusicconference[.]us 
hxxp://swartandfeliciani[.]us 


hxxp://teslashoes[.]us 
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hxxp://thinkql[.]Jus 
hxxp://thegioixedien[.]us 
hxxp://writesuperessay[.]us 
hxxp://cledara[.]Jus 
hxxp://muellerinsurance[.]us 
hxxp://ceritaseks[.]us 
hxxp://gofastracing[.]Jus 
hxxp://ympanamashop[.]us 
hxxp://menonvacation[.]us 
hxxp://negociosonline[.]us 
hxxp://projectnimb[.]Jus 
hxxp://prodialup[.]us 
hxxp://chelseaartsuitesny[.]us 
hxxp://moviecity[.]us 
hxxp://singzer[.]us 
hxxp://ultralite[.Jus 
hxxp://proxyz[.]us 
hxxp://naturson[.]us 
hxxp://romtest[.]us 
hxxp://goldminesales[.]us 
hxxp://ministeriosdeesperanzal[.]us 
hxxp://quentintarantino[.]us 
hxxp://gprspro[.]us 
hxxp://kcarrental[.Jus 
hxxp://cardonationinma[.]us 
hxxp://vigilantarms[.]us 
hxxp://intok[.]us 
hxxp://foreverbloom[.]us 
hxxp://stepsinc[.]us 
hxxp://comhuaren[.]us 
hxxp://bombaybazarcharleston[.]us 
hxxp://beraldgroups[.]us 
hxxp://guidepedial[.]Jus 
hxxp://pollparty[.Jus 
hxxp://supinehotels[.]us 
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hxxp://thepiratefilmeshd[.]us 
hxxp://babelphotos[.]us 
hxxp://washingtonbusinesses[. ]us 
hxxp://miamipersonalinjuryattorney[.]us 
hxxp://myagentnow|[.]us 
hxxp://amitsharma[.]us 
hxxp://wardconstruction[.]us 
hxxp://baltimorepreferred[.]Jus 
hxxp://alliedfit[.]us 
hxxp://gildedlilygallery[.]us 
hxxp://leatherboots[.]us 
hxxp://nistarshop[.]us 
hxxp://gpsinc[.]Jus 
hxxp://slotsforrealmoney[.]us 
hxxp://volumemarketing[.]us 
hxxp://buyersadvantagerealty[.]us 
hxxp://agilify[.Jus 
hxxp://shopboswell.]Jus 
hxxp://dallasevictionlaw[.]us 
hxxp://noemotion[.]us 
hxxp://youmailer[.]us 
hxxp://vilascountywil[.]us 
hxxp://latenightbrass[.]us 
hxxp://marissolutions[.]us 
hxxp://cleanbody[.]Jus 
hxxp://dignewton[.]us 
hxxp://aidite[.]us 
hxxp://skindaron[.]Jus 
hxxp://telcomsystem[.]us 
hxxp://primewaysavings[.]us 
hxxp://uprightbrooms[.]us 
hxxp://raybanoutletsun[.]us 
hxxp://themixedbag[.]us 
hxxp://fortnitoffers[.]us 


hxxp://ultralumino[.]Jus 
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hxxp://ihateaccenture[.]us 
hxxp://planningahead[.]us 
hxxp://pioneerpreschool[.]us 
hxxp://renewableofsupport[.]us 
hxxp://wideopenholdings[.]us 
hxxp://venomlettherebecarnage[.]us 
hxxp://cvservices[.]us 
hxxp://allianceservices[.]us 
hxxp://skypechannelpartner[.]us 
hxxp://clashroyalecheats[.]us 
hxxp://ycorn[.]us 
hxxp://fishscales[.]us 
hxxp://fbstore[.]us 
hxxp://myhairon[.]us 
hxxp://medicaldevicenews|[.]us 
hxxp://organano[.]us 
hxxp://queensfashions[.]us 
hxxp://franklincountrync[.]us 
hxxp://rareantiquerings[.]us 
hxxp://debilitating[.]us 
hxxp://pearsonintrocommunication[.]us 
hxxp://stickermap[.]us 
hxxp://hottechreviews[.]us 
hxxp://militarygrade[.]us 
hxxp://getalakelife[.Jus 
hxxp://americantouch[.]us 
hxxp://asimpleswitch[.]us 
hxxp://bonsaitrees[.]us 
hxxp://ideaspeak[.]us 
hxxp://ksacareers[.]us 
hxxp://williamcruz[.Jus 
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hxxp://dvddream[.]us 
hxxp://renobusiness[.]us 
hxxp://bobparks[.]us 
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hxxp://swedishautowerks[. ]us 
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hxxp://braziliantouch[.]us 
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hxxp://steamstatu[.]us 
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hxxp://hippoexpress[.]us 
hxxp://henrysflorist[.]us 
hxxp://hansonwelding[.]us 
hxxp://phillyah[.]us 
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hxxp://palmair[.]us 
hxxp://palmess[.]us 
hxxp://optimaltraining[.]us 
hxxp://marionsconstructionweldingllc[.]us 
hxxp://myzestfullife[.]Jus 
hxxp://prosteasteratsm[.]us 
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hxxp://moonlightandlace[.]us 
hxxp://pristineconstruction[.]us 
hxxp://prusikholding[.]us 
hxxp://shopculture[.]us 
hxxp://shouyou[.]us 
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hxxp://stopthechaos[.]us 
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hxxp://homeoutdoor[.]us 
hxxp://ibuilder[.Jus 
hxxp://goldenvalleyvanlines[.]Jus 
hxxp://ettoline[.]us 
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hxxp://illinoispay[.]Jus 
hxxp://ideapros[.]us 
hxxp://everso[.]us 
hxxp://instantsfun[.]Jus 
hxxp://freshlegumes[.]us 
hxxp://glaca[.]us 
hxxp://jeremiblurton[.Jus 
hxxp://insig[.]Jus 
hxxp://hottubdealer[.]Jus 
hxxp://hodomanial[.]us 
hxxp://infinityconsult[.]us 
hxxp://freshprom[.]us 
hxxp://facethemusic[.]us 
hxxp://fontono[.]Jus 
hxxp://doersindex[.]us 
hxxp://kansascityrefinishing[.]us 
hxxp://deviceideaday[.]us 
hxxp://easyhairdress[.]us 
hxxp://neintzmancorporation[.]us 
hxxp://greatcontent[.]us 
hxxp://hankerchief[.]us 
hxxp://ecifinancial[.Jus 
hxxp://ketomezyvshop[.]us 
hxxp://jobsearchforindia[.]us 
hxxp://donandjennifer[.]us 
hxxp://directorfusion[.]us 
hxxp://donorth[.]Jus 
hxxp://earntheory[.]us 
hxxp://directnewleads[.]us 
hxxp://kindof[.]Jus 
hxxp://joshgregoryrealestate[.]us 
hxxp://freefarms[.]Jus 
hxxp://justrecipes[.]us 
hxxp://kingdombuildingministries[.]us 


hxxp://emassachusettstaxreturn[.]us 
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hxxp://hellorentals[.]us 
hxxp://electladendorf[.Jus 
hxxp://kamanahai[.]us 
hxxp://ebdesigns[.]us 
hxxp://docholliday[.Jus 
hxxp://johnsherrod[.]Jus 
hxxp://designconvicted[.]us 
hxxp://digitalebooks[.]us 
hxxp://keralahouseboats[.]us 
hxxp://gymnasticusa[.]us 
hxxp://electroserve[.]us 
hxxp://healthilymaill[.]us 
hxxp://joemart[.]us 
hxxp://jobdetective[.]us 
hxxp://hiddendeals[.]us 
hxxp://loquetegustal[.]us 
hxxp://leimaginer[.]us 
hxxp://michaelgraves[.]us 
hxxp://lindseyandandrew[.]us 
hxxp://lessonsforlifetrust[.]us 
hxxp://maskmarket[.]us 
hxxp://marmots[.]us 
hxxp://ladiesshoes[.]us 
hxxp://monoclinic[.]us 
hxxp://marleene[.]us 
hxxp://maswell[.Jus 
hxxp://limagenerations[.]us 
hxxp://lighthouseservicesllc[.]us 
hxxp://liangtsewellness[.]us 
hxxp://lafwell[.Jus 
hxxp://merchmanial[.]Jus 
hxxp://militaryepack[.]us 
hxxp://meetdreamdate[.]us 
hxxp://meritbrands[.]us 
hxxp://littlereddoor[.]Jus 
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hxxp://lingelbach[.]Jus 
hxxp://kmbphotos[.]us 
hxxp://mizunovolleyballshoes[.]us 
hxxp://kinia[.]us 
hxxp://metasupply[.]Jus 
hxxp://metaloans[.]us 
hxxp://mymobilenation[.]us 
hxxp://myindependenceday[.]us 
hxxp://myloanforgiveness[.]us 
hxxp://mysoapsandstuff[.]us 
hxxp://mwelectric[.]us 
hxxp://naturalsolution[.]us 
hxxp://needleminders[. ]us 
hxxp://nesshop[.]us 
hxxp://newbeginningservices[.]us 
hxxp://newheral[.]us 
hxxp://newnikeshoesonsale[.]us 
hxxp://offsetcredit[.Jus 


hxxp://nnectorthpahomarker[.]us 


hxxp://northfaceapexbionicjacket[.]us 


hxxp://nortonrosefulbright[.]us 
hxxp://richardporter[.]us 
hxxp://prettylittletjing[.Jus 
hxxp://silverpresent[.]us 
hxxp://politicalsky[.]Jus 
hxxp://ringoldcounty[.]us 
hxxp://realestatewebsitedesignI[.]us 
hxxp://painsupportgroup[.]us 
hxxp://precisionperformance[.]us 
hxxp://perezlandscaping[.]us 
hxxp://protopreneurs[.]us 
hxxp://shipcon[.]us 
hxxp://rmnderskasoaq[.]us 
hxxp://shortcircuitclan[.Jus 


hxxp://pathwayministries[.]us 
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hxxp://pasoli[.]us 

hxxp://poetral.]Jus 
hxxp://pyrocandles[.]us 
hxxp://periscopelivel[.]us 
hxxp://pandoraringsjewelry[.]us 
hxxp://roardlismilliderlik[.Jus 
hxxp://pawleysislandbrewing[.]us 
hxxp://peaceofmindinretirement[.]us 
hxxp://protectcenter[.]us 
hxxp://plantalytics[.]us 
hxxp://smartcoast[.]us 
hxxp://pharmiq[.]Jus 
hxxp://sanantoniodebtconsolidation[.]us 
hxxp://onereason[.]us 
hxxp://ominihome[.]us 
hxxp://pddperfectdarlingdog[.]us 
hxxp://rachaeljones[.]us 
hxxp://professionalpain[.]us 
hxxp://reauestysstrangesecurenetwork[.]us 
hxxp://singgaravellosubramaniam|[.]us 
hxxp://optimalhealthcare[.]us 
hxxp://porshaestronger[.]us 
hxxp://raskebriller[.]us 
hxxp://puresouls[.]us 
hxxp://pythonlanguage[.]us 
hxxp://ptheme|[.]us 
hxxp://preciouscards[.]us 
hxxp://sarderkamruzzaman[.]us 
hxxp://realliberty[.]us 
hxxp://paanesthesiaworld[.]us 
hxxp://satisfactor[.Jus 
hxxp://propertysales[.]us 
hxxp://paleodietrecipes[.]us 
hxxp://romestive[.]us 
hxxp://percentagegiving[.]us 
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hxxp://porterm[.]us 
hxxp://pieratti[.]us 


hxxp://pomarico[.]us 


hxxp://plumbingheatingservices[.]us 


hxxp://rudate[.]us 
hxxp://republicanview[.]us 
hxxp://outletsdeall[.Jus 
hxxp://protechnic[.Jus 
hxxp://oofbrand[.]Jus 
hxxp://ptericeedainicipetr[.]us 
hxxp://selfcheckout[.]us 
hxxp://satinsilkyhair[.]us 
hxxp://supportswf[.]us 
hxxp://sperez[.]us 
hxxp://sorteo[.]us 
hxxp://springle[.]us 
hxxp://tctalk[.Jus 
hxxp://speedmachine[.]us 
hxxp://southeservices[.]us 
hxxp://springoflove[.]Jus 
hxxp://syassi[.]us 
hxxp://teachsignalboosterjhsjh[.]us 
hxxp://starkcom[.]us 
hxxp://swaril.]us 
hxxp://susports[.]us 
hxxp://aspectclinica[.]us 
hxxp://ardzorg[.]us 
hxxp://anastruetaste[.]us 
hxxp://arcadestudio[.]us 
hxxp://advanceenergypatches[.]us 
hxxp://annesundara[.]us 
hxxp://asoundguy[.]us 
hxxp://aeomfashion[.]us 
hxxp://ayoungeryou[.]us 


hxxp://bisonenergy[.]us 
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hxxp://abettertime[.]us 
hxxp://scottil[.]us 
hxxp://rqkqrwajdal[.Jus 
hxxp://fancyjewels[.]us 
hxxp://boatid[.]us 
hxxp://fancyice[.]us 
hxxp://grandesmaestrosdelaluz[.]Jus 
hxxp://cohanal[.]us 
hxxp://droverrid[.]Jus 
hxxp://equinewayl[.]us 
hxxp://favell[.Jus 
hxxp://hendersonmobilenotary[.]us 
hxxp://desertnightsmobilecasino[.]us 
hxxp://biotechsolutions[.]us 
hxxp://daysonmarke[.]us 
hxxp://dantruon[.]us 
hxxp://hotelestrinidad[.Jus 
hxxp://homeoflabretrievers[.]us 
hxxp://blithe[.]us 
hxxp://dancecountry[.]Jus 
hxxp://hitechehrexam[.]us 
hxxp://homebedfurniture[.]us 
hxxp://hotelsinvestment[.]us 
hxxp://goingsane[.]us 
hxxp://keepfoxsportsnorth[.]us 
hxxp://jinsha[.]us 
hxxp://Idconstruction[.]us 
hxxp://jinglelady[.]us 
hxxp://leaderdesign[.]us 
hxxp://carefromanywhere[. ]us 
hxxp://despotism[.]us 
hxxp://leslieroofing[.]us 
hxxp://honeymoongetawayl. Jus 
hxxp://jacksonlandscape|[.]us 
hxxp://histgroup[.]us 
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hxxp://contactzara[.]us 
hxxp://boxstore[.]us 
hxxp://birkenstockshop[.]us 
hxxp://belverbears[.]us 
hxxp://awesomeorlando[. ]us 
hxxp://groupelogo[.]us 
hxxp://agreencompany|[.]us 
hxxp://databinders[.]us 


hxxp://abandonedlots[.]Jus 


hxxp://homesforsaleflorida[.]us 


hxxp://healthyknees[.]us 
hxxp://carboncases[.]us 
hxxp://blessedmom|[. Jus 
hxxp://kilgoreindustries[.]us 
hxxp://globear[.]us 
hxxp://collegepartystorie[.]us 
hxxp://handwear[.]us 
hxxp://dzinewerx[.]us 
hxxp://gtell[.Jus 
hxxp://dodgefuelfilters[.]us 
hxxp://formatti[.]us 
hxxp://katieandchris[.]us 
hxxp://creatiivetent[.]us 
hxxp://energyestimator[.]us 
hxxp://concordmills[.]us 
hxxp://hirethislens[.]us 
hxxp://dramatists[.]us 
hxxp://conservativepc[.]us 
hxxp://cartoonme[.]us 
hxxp://applydesign[.]Jus 
hxxp://khprofor[.]us 
hxxp://desireezirolli[.Jus 
hxxp://handylife[.]Jus 
hxxp://ketodiwerishop[.]us 


hxxp://awesomeauctions[.]us 
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hxxp://alyseandcam[.]us 
hxxp://dnsonlin[.]us 
hxxp://cardtricks[.]us 
hxxp://ineah[.]us 
hxxp://davisfamilyreunion[.]us 
hxxp://linkhomedecor[.]us 
hxxp://donlineshop[.]us 
hxxp://headlesschicken[.]us 
hxxp://canineadventures[.]us 
hxxp://homehackss[.]us 
hxxp://gourmetgiftcollections[.]us 
hxxp://letsalltalk[.Jus 
hxxp://brilliantnurse[.]us 
hxxp://cmcomputers[.]us 
hxxp://hotlife[.]us 
hxxp://lapuente[.]us 
hxxp://aactrucking[.]us 
hxxp://fitnessvideosite[.]us 
hxxp://learnscape[.]us 
hxxp://batmangames|[.]us 
hxxp://isitesdigitalmediallc[.]us 
hxxp://creativecoating[.]us 
hxxp://gemsforless[.]us 
hxxp://lookseeddesign[.]us 
hxxp://blackpine[.]us 
hxxp://kmcfarland[.]Jus 
hxxp://jkhome[.]Jus 
hxxp://finalopt[.]us 
hxxp://fxpresyk[.]Jus 
hxxp://himalayanownersclub[.]us 
hxxp://impactgroupholdings[.]us 
hxxp://blackeagleequipment[. ]us 
hxxp://careandlovel[.]us 
hxxp://basecampvans[.]us 
hxxp://dropwing[.]us 
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hxxp://candlesoydeuce[.]us 
hxxp://hearthboost[.]us 
hxxp://imransbarbersalon[.]us 
hxxp://insurancephoto[.]us 
hxxp://listahouse[.]us 
hxxp://cardamom[.]us 
hxxp://incorporations[.]us 


hxxp://horsecavetheatr[.]us 


hxxp://apartmentsandhousesforrent[.]us 


hxxp://energychoices[.]us 
hxxp://jossandmain[.]us 
hxxp://frontsightdefense[.]us 
hxxp://gistmack[.]us 
hxxp://greendepartment[.]us 
hxxp://jpsbschooll[.Jus 
hxxp://absorbingstints[.]us 
hxxp://kitala[.]us 
hxxp://illuminatedconsulting[.]us 
hxxp://bravernewworld[.]us 
hxxp://kdjanitorservice[.]us 
hxxp://felonsual[.]Jus 
hxxp://integrityautobrokers[.]us 
hxxp://desertinnmedicalcenter[.]us 
hxxp://bankerslifeagent[.]Jus 
hxxp://embracinglif[.]us 
hxxp://communitylistingboar[.]us 
hxxp://crystalhost[.]us 
hxxp://exerciseessentials[.]us 
hxxp://delllaptopbatter[.]Jus 
hxxp://lionwayl[.]us 
hxxp://maturezone[.]us 
hxxp://propertyattorney[.]Jus 
hxxp://yournmatch[.]us 
hxxp://plumbplumbing[.]us 
hxxp://theinformers[.]us 
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hxxp://dreamparrotsaviary[.]us 
hxxp://deltaticketsvouchers[. ]us 
hxxp://earnearns[.]us 
hxxp://carryonshoulderbags[.]us 
hxxp://estibrands[.]Jus 
hxxp://bbsmart[.]us 
hxxp://martimedocumentation[.]us 
hxxp://gtdistribution[.]us 
hxxp://technologypresident[.]us 
hxxp://intercessionversity[.]us 
hxxp://bhhseducation[.]us 
hxxp://inlandempireer[.]us 
hxxp://waterproofpouches[.]us 
hxxp://alfatronics[.]Jus 
hxxp://kitchenculture[.]Jus 
hxxp://mypandastream[.]us 
hxxp://sballc[.]us 
hxxp://ralphlaurenonlineoutlet[.Jus 
hxxp://caentes[.]us 
hxxp://cesiinc[.]us 
hxxp://azborderwatch[. Jus 
hxxp://carseatcushions[.]us 
hxxp://compucam|[.]us 
hxxp://mountaintopsupply[.]us 
hxxp://razoredgerecruiting[.]us 
hxxp://homeservicesolutions[.]us 
hxxp://ideacamp[.]us 
hxxp://postimagel[.]us 
hxxp://prestigeautorepair[.]us 
hxxp://altwaystoheall[.Jus 
hxxp://airsole[.]us 
hxxp://bigblockchain[.]us 
hxxp://bodylifedirect[.]us 
hxxp://pureskinaesthetics[.]us 
hxxp://supporthemp[. Jus 
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hxxp://vernessersofterrake[.]us 
hxxp://eventcrowd[. ]us 
hxxp://dmvuslicenseupdate[.]us 
hxxp://edesirs[.]us 
hxxp://escortlogistics[.]us 
hxxp://mgmtcleaning[.]us 
hxxp://americanreloading[.]us 
hxxp://advantageplumbing[.]us 
hxxp://ticsyste[.]us 
hxxp://thatonegeek[.]us 
hxxp://hlinstitute[.Jus 
hxxp://ioncard[.]us 
hxxp://versatileconsulting[.]us 
hxxp://aonews[.]us 
hxxp://islanddreams[.]us 
hxxp://thesimmonsfamily[.]us 
hxxp://thrillington[.]us 
hxxp://ccentetliarandantis[.]us 
hxxp://coupchop[.]us 
hxxp://keyindustries[.]us 
hxxp://memorytrail[.Jus 
hxxp://thegloriouscause[.]us 
hxxp://spermcocktail[.]Jus 
hxxp://banditworkshop[.]us 
hxxp://ebdesignz[.Jus 
hxxp://premins[.]us 
hxxp://nobsnutrition[.]us 
hxxp://dobestsite[.]us 
hxxp://fancyartshop[.]us 
hxxp://freshnbrite[.]us 
hxxp://realtyb[.]us 
hxxp://picshouse[.]us 
hxxp://usita[.]Jus 
hxxp://braingle[.Jus 
hxxp://indexpark[.]us 
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hxxp://umassp[.]us 
hxxp://financecourses[.]us 
hxxp://bcimages[.]us 
hxxp://friendsforjustice[.]us 
hxxp://allenphoto[.]us 
hxxp://donnellyphotography[.]us 
hxxp://insors[.]us 
hxxp://moviefreak[.]us 
hxxp://taxforeclosure[.]us 
hxxp://titaninsurance[.]us 
hxxp://womenifaltutaionsj[.]us 
hxxp://greenfeathersroof[.]us 
hxxp://endingsinc[.]us 
hxxp://directedlubricationbearings|[.]us 
hxxp://glamorlighting[.]us 
hxxp://gunviolencestats[.]us 
hxxp://exceptionalextractions[.]us 
hxxp://elitemedicalstaffingsolutions[.]us 
hxxp://stepmoon|[.]us 
hxxp://skypers[.]us 
hxxp://skyesthelimit[.]us 
hxxp://prohibitionlabs[.]us 
hxxp://nextplastics[.]us 
hxxp://tennesseetours[.]us 
hxxp://madisonint[.]us 
hxxp://nadsofttestingdomain[.]us 
hxxp://naturallyaustin[.]us 
hxxp://treeherd[.Jus 
hxxp://youserv[.]us 
hxxp://ghostshow[.]us 
hxxp://abundantwaterwells[.]us 
hxxp://inethosting[.]us 
hxxp://freshdesain[.]us 
hxxp://softlovestore[.]us 
hxxp://recomendedbook[.]us 
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hxxp://datsailis[.]us 
hxxp://visaracapitall[.]us 
hxxp://yourmobilechurch[.]us 
hxxp://emailextractor[.]us 
hxxp://mitchmallows[.]us 
hxxp://unitytalent[.]Jus 
hxxp://martineztreeservice[.]us 
hxxp://violations[.]us 
hxxp://themakings[.]us 
hxxp://compassmanufacturingllc[.]us 
hxxp://thekitchengallery[.]us 
hxxp://zenmatchate[.]us 
hxxp://waypointservices[.]us 
hxxp://transferet[.]us 
hxxp://thewrightcompanyinc[.]us 
hxxp://trachtmanlabs[.]us 
hxxp://theletterafte[.]us 
hxxp://theseedroom[.]us 
hxxp://uvbbshop[.]us 
hxxp://treeandlandscaping[.]us 
hxxp://wearemilitia[.]us 
hxxp://tothetoptraining[.]us 
hxxp://wallyhome[.]us 
hxxp://ticketbooth[.]us 
hxxp://vineyar[.]us 
hxxp://wearethechildren[.]Jus 
hxxp://thetshirtproject[.]us 
hxxp://twohighmill[.]us 
hxxp://urvespaternsandpins[.]us 
hxxp://theunicornphotographer[.]us 
hxxp://truthanddemocracyl.]us 
hxxp://vedanthealth[.]us 
hxxp://vffessayto[.]us 
hxxp://wellrounded[.]us 


hxxp://versatilestyle[.]us 
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hxxp://truelovelives[.]Jus 
hxxp://tippingpointpal[.]us 
hxxp://tsisports[.]us 
hxxp://theebonycarpenter[.]us 
hxxp://thecbal[.]us 
hxxp://wanderingweavers[.]us 
hxxp://yummybest[.]us 
hxxp://travelpartners[.]Jus 
hxxp://variedadesrd[.]us 
hxxp://vernos[.]us 
hxxp://weddingcustom|[.]us 
hxxp://worldwidelocations[.]us 
hxxp://urbpro[.]us 
hxxp://theyankeecat[.]us 
hxxp://tildeathdoisparty[.]us 
hxxp://urbanbedding[.]us 
hxxp://worthcart[.]us 
hxxp://verteatro[.]us 
hxxp://thegrapevines[.]us 
hxxp://washingtonconsultinggroup[.]us 
hxxp://worshap[.]us 
hxxp://thehairflare[.]us 
hxxp://commyhilfigerdresses[.]us 
hxxp://yolocard[.]us 
hxxp://truedirections[.]us 
hxxp://valiantconstruction[.]us 
hxxp://thethemasters[.]us 
hxxp://valleyea[.]us 
hxxp://yfiyshop[.]us 
hxxp://youacard[.]us 
hxxp://visualinnovationsandsolutions[.]us 
hxxp://womeninwellness[.]us 
hxxp://voirea[.]Jus 
hxxp://townsendindustries[.]us 
hxxp://wallacecookagency|[.]us 
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hxxp://uswebsters[.]us 
hxxp://tomboland[.]Jus 
hxxp://xavierandmarie[.]us 
hxxp://uniquelashes[.]us 
hxxp://unitarian[.]us 
hxxp://womeninfalutaion[.]us 
hxxp://uncosmicoeverafter[.]us 
hxxp://viralinda[.]us 
hxxp://vincesmith[.]us 
hxxp://uscgdocuentation[.]us 
hxxp://viphorse[.]us 
hxxp://ustraveldoc[.]us 
hxxp://wholesalejerseyscheapstore[.]us 
hxxp://valleyviewhomes|[.]us 
hxxp://wearehb[.]us 
hxxp://washingtonians[.]us 
hxxp://yamin[.]us 
hxxp://unsocialengineering[.]us 
hxxp://walkonwaterproductions[.]us 
hxxp://ushotels[.]us 
hxxp://zhanenicole[.]us 
hxxp://weloveournewwindows[. ]us 
hxxp://zenithpetcarriers[.]us 
hxxp://veteranteams[.]us 
hxxp://viddiscounts[.]us 
hxxp://venturacharter[.]us 
hxxp://yourfundsolutions[.]us 
hxxp://firefalcon[.]us 
hxxp://urbanessentials[.]us 
hxxp://highsloth[.]us 
hxxp://yeastrol[.]us 
hxxp://wholesalejerseysbuy[.]us 
hxxp://westervilleohio[.]us 
hxxp://whatisredlining[.]us 


hxxp://wethenews[.]us 
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hxxp://upthecreekmobile[.]us 
hxxp://visiblyrefined[.]us 
hxxp://chiste[.]us 
hxxp://winsacards[.]us 
hxxp://coinstracker[.]us 
hxxp://wifiboosters[.]us 
hxxp://diversityaction[.]us 
hxxp://wilsonfinley[.]us 
hxxp://tnesl[.]us 
hxxp://thecamping[.]us 
hxxp://tinurl[.]us 
hxxp://thejuanforalainal[.Jus 
hxxp://thegreekgroup[.]us 
hxxp://thejesters[.]us 
hxxp://travelclinic[.]us 
hxxp://thebenc[.]us 
hxxp://themastersgolf[.]us 
hxxp://trampoja[.]us 
hxxp://thecamerastore[.]us 
hxxp://thebariatriccenter[.]us 
hxxp://thunderrbird[.]us 
hxxp://thegopros[.]us 
hxxp://understandwhat[.]us 
hxxp://thereavers[.]us 
hxxp://thinkandgrow|[.]us 
hxxp://themclaurins[.]us 
hxxp://topdoggarage[.]us 
hxxp://thefashionista[.]us 
hxxp://totomakinesil[.]us 
hxxp://theozone[.]us 
hxxp://theknottedline[.]us 
hxxp://apluslending[.]us 
hxxp://racetric[.]us 
hxxp://testerfog[.]us 
hxxp://tempusanalytics[.]us 
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hxxp://sidehall[.]Jus 
hxxp://surveyman[.]us 
hxxp://sunnysavings[.]us 
hxxp://houseofstars[.]us 
hxxp://gossiptrend[.]Jus 
hxxp://alittleartgallery[.]us 
hxxp://billclintonontour[.]us 
hxxp://amazingcare[.]us 
hxxp://kscommunication[.]us 
hxxp://instantlyageless[.]us 
hxxp://installwordpress[.]us 
hxxp://bondbrothes[.]us 
hxxp://lifefin[.Jus 
hxxp://interactivetech[.]us 
hxxp://coinring[.]us 
hxxp://ianny[.]us 
hxxp://jbconcrete[.]us 
hxxp://lifestyletherapy[.]us 
hxxp://hobsons[.]us 
hxxp://energla[.]us 
hxxp://happyonline[.]us 
hxxp://icharacter[.]us 
hxxp://clearconnection[.]us 
hxxp://lionheadcapitall[. ]us 
hxxp://cleanbrace[.]us 
hxxp://bootscheal[.]Jus 
hxxp://bamaoutlet[.]us 
hxxp://ketodietprogram|[.]us 
hxxp://anachronism[.]us 
hxxp://foooreeever[.]us 
hxxp://excelconstruction[.]us 
hxxp://amoundev[.]us 
hxxp://nitrome[.]Jus 
hxxp://maxicollection[.]us 


hxxp://ninosrestaurant[.]us 
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hxxp://noodlenet[.]us 
hxxp://newscurrent[.]us 
hxxp://nineplanets[.]us 
hxxp://merelyplayers[.]us 
hxxp://mediatefirst[.]us 
hxxp://lovelifts[.Jus 
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hxxp://servicplysstrangedigital[.]us 
hxxp://pointgra[.]us 
hxxp://ozones[.]us 
hxxp://tetxfree[.Jus 
hxxp://sallela[.Jus 
hxxp://rallywow[.]us 
hxxp://sportstopics[.]us 
hxxp://rehablocator[.]us 
hxxp://storybrookhomes[.]us 

332 


hxxp://pinangell[.]us 
hxxp://sacredrosetea[.]us 
hxxp://photoworkshop[.]us 
hxxp://shames[.]us 
hxxp://showscast[.]us 
hxxp://reiten[.]us 
hxxp://prendil[.]us 
hxxp://shoblog[.]Jus 
hxxp://pfchangshomemenu[.]us 
hxxp://sprinklefamily[.]us 
hxxp://storyme[.]us 
hxxp://remettrebul.]us 
hxxp://royalinnpearsall[.Jus 
hxxp://scaleput[.]us 
hxxp://reliv[.Jus 
hxxp://ssscarwash[.]us 
hxxp://stelladot[.]us 
hxxp://steaksou[.]us 
hxxp://ragamuffinclothing[.]us 
hxxp://replacementkeyfobs[.]us 
hxxp://stoneresearch[.]us 
hxxp://optiomobile[.]us 
hxxp://pushthebutton[.]us 
hxxp://steamtraps[.]us 
hxxp://perfecttranscription[.]us 
hxxp://shallfour[.]us 
hxxp://optonlin[.]us 
hxxp://orlandohome[.]us 
hxxp://stinktown[.]us 
hxxp://saltworld[.]us 
hxxp://rapidmovers[.]us 
hxxp://outsidetogether[.]us 
hxxp://purpletables[.Jus 
hxxp://shirehorse[.]us 


hxxp://psychologistnj[.]us 


333 


hxxp://silverhook[.]us 
hxxp://ryances[.]us 
hxxp://skylighttech[.]us 
hxxp://tapestryking[.]us 
hxxp://swesthealth[.]us 
hxxp://taint[.Jus 
hxxp://strakedixmoorcondorcet[.]us 
hxxp://takeoutmenul[. ]us 
hxxp://ssintl[.Jus 
hxxp://rubriblast[.]us 
hxxp://renewyourdomainname|[.]us 
hxxp://sinnersandsaintsbeardco[.]us 
hxxp://shopsangtao[.]us 
hxxp://seatqwest[.]us 
hxxp://propertyinvestor[.]us 
hxxp://stephaniescruggs[.]us 
hxxp://simplyfinanciall[.]us 
hxxp://pentagrid[.]us 
hxxp://wstest[.]us 
hxxp://torosgroup[.]us 
hxxp://tiendamoviles[.]us 
hxxp://watsoncameron[. ]us 
hxxp://thebutterflypeal[.]us 
hxxp://thelakemartinlife[.Jus 
hxxp://transformationnation|[.]us 
hxxp://theleadershipjourney[.]us 
hxxp://infantstylenolcold[.]us 
hxxp://idiversify[.]us 
hxxp://greatestspokesperson|[.]us 
hxxp://greefieldwil[.]us 
hxxp://getrealwatts[.Jus 
hxxp://homewarrantytest[.]us 
hxxp://ethissalon[.]us 
hxxp://jerseyall[.Jus 
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hxxp://immigrationlegalservices[.]us 
hxxp://americasbetterburge[.]us 
hxxp://allaroundhealt[.]Jus 

336 


hxxp://carsimg[.]us 
hxxp://bcscomputerservices[.]us 
hxxp://collectivecommunity[.]us 
hxxp://doctorion[.]us 


hxxp://hotelsinistanbu[.]us 


hxxp://nhomeimprovementadvantagel[.]us 


hxxp://entryleve[.Jus 
hxxp://carpetandtilecleaners[.]us 


hxxp://celebritymarketing[.]us 


hxxp://indainsweetsfoodandspices[.]us 


hxxp://emortalsports[.]us 
hxxp://americancarparts[.]us 
hxxp://fastheat[.]us 
hxxp://anitalouis[.]us 
hxxp://bellabailey[.]us 
hxxp://contractorwebsite[.]us 
hxxp://indianapolispreferred[.]us 
hxxp://bootlegradi[.]us 
hxxp://festivalbudd[.]Jus 
hxxp://amsdstribution[.]us 
hxxp://hazardcity[.Jus 
hxxp://foodtraders[. ]us 
hxxp://beautysecretstoday[.]us 
hxxp://cmstutoria[.]us 
hxxp://emarketingonline[.]us 
hxxp://bornandraise[.]us 
hxxp://euxaugmente[.]us 
hxxp://chesstempo[.]us 
hxxp://claritystudious[.]us 
hxxp://coolcrap[.]us 
hxxp://actionsportsgames[.]us 
hxxp://httpscomersano[. ]us 
hxxp://carolinapanthersstore[.]us 
hxxp://charliehomedecor[.]us 


hxxp://artofspace[.]us 


337 


hxxp://hattemer[.]us 
hxxp://homecareangels[.]us 
hxxp://houseofplastic[.]us 
hxxp://fiberglassbar[.]us 
hxxp://graphenemodel[.]us 
hxxp://badasssolutions[.]us 
hxxp://americanbran[.]Jus 
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hxxp://cablecutconnection[.]us 
hxxp://carbonmonoxidedetectors[.]us 
hxxp://afriquearbitrage[.]us 
hxxp://calypsowireless[.]us 
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hxxp://bbdentall[.]Jus 

344 


hxxp://indigomountain[.]us 
hxxp://gossoons[. ]us 
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So, what’s the news? Already done. 
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1.1.14 Upcoming Bulgaria 24 TV Show "Cyber Wars" Participation (2023-03-31 10:52) 


Dear blog readers, 
417 


Great news. It appears that I'll be participating in the upcoming TV show "Cyber Wars" on 
Bulgaria 24 channel with an interview. 


| wanted to say big thanks to the filming crew and the host for the invitation and the questions 
and | hope that we’ll soon meet again for yet another interview and a conversation. 


[3] 
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You can watch it [5]here. 
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1.2 April 


1.2.1 Dancho Danchev’s Video Interview at Bulgaria 24’s "Cyber Wars" TV Show 
(2023-04-01 20:43) 


iN 


20 


Dear blog readers, 


Feel like watching my latest and what appears to be first video interview on Bulgaria’s national 
television Bulgaria 24’s "Cyber Wars" TV show? 


Watch it [2]here or [3]here. 
Stay tuned! 


1. https: //blogger .googleusercontent .com/img/a/AVvXsEi JZIncIG78hJV80uW7NrxQICnYldgzGTpJYSZ131aN-2ywaUCO jGJAtq 
RRORrsBO j 8- dEwlWeKKWxpkEW16meGWy A8NyPDHHvr5SWj315JVb2D 

2. https://drive.google.com/file/d/1r80C9mtHayAar-boeC2v1lFWwvouC2qGj/view?usp=drivesdk 

3. https://youtu. be/plplc3wvaaM 


1.2.2 Exposing the Fashion Brands of the Conti Ransomware Group (2023-04-06 23:43) 


[1] 
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Dear blog readers, 


I’ve decided to share with everyone a series of photos obtained by data mining the recently 
leaked Conti ransomware gang’s internal communications with the idea to raise awareness 
on some of the fashion brands supposedly managed and operated by members of the 
[2]Conti ransomware gang. 


Sample personally identifiable information: 
hxxp://www.wildberries.ru/brands/leylo 
hxxp://instagram.com/leylo _wear 
leyloekb@gmail.com 

+7-912-633-13-03 

hxxp://leylo.ru/ 
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hxxp://vk.com/leylo _wear 


Sample photos include: 
[3] 


TAWEWABEAAOCTMHBIMIABOB 
nPv 5 MORNEEMKGCHN SBE3/, TENEKAHANOB 


Moss Ylnet 
2020 


Memdyn Mtottt 


WOK ? COON 1G6A 


B NODAPOK \OBEIMPHAR KOPOHA 
Vi APYTME LEHHbIE NPMSbI 


[4] 
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[5] 


424 


] 


6 


[ 
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[7] 


426 


Ae€TCKadrA OfCXLa 


[8] 


CHENATb 3AKA3! 


[9] 


428 


[10] 


429 


430 


0S, 


LUXURY PROMOTIONS 


PASSIONATE APO ELEGANCE 


GRES 


[11] 


ASCMUROUP 


Stay tuned! 


1. hvtps:/Paloggergoogleuser content. cou/ing/a/IVRSEOjatSPAVYTO)aDOu6-125gSH_ R2Ac Che xEPOHOTRETAURSTSACK 
2. https: //ddanchev. blogspot .com/2022/02/exposing-conti-ransomware-gang-osint_28.htm 

3, notps:/ Pulogger googleusercontentcou/ing/a/ IV et gy7SASVe ovat gITO-nrycbV ay ct PERFSSADRCLM RTOTSPIG 
"hotps:/ fologger.googleuser content .con/ing/a/AKsEnNaSTS- 2a YEILAECOBNac_OiOTEOLSuGHsve-OBeeFVOTS 


5, hep: / blogger. googleusercont ent .con/ing/a/AVWXsE: quaqLfuBKF-o86vRGEViniBLalgidivtc® jay-KeTaduBNpi6ITaLi 
"https: / blogger. googleusercontent .con/ing/a/AV ksi dehrsixuDELYHO7Ip2-240U waited XCNot GEkUyOveBFBGICuzduta 


(o>) 


ymPMaaRk21ddyo4Rq0kQ7wxbR- 8Y3BX3eVQHU JPPo40CkFcrT_61zZE 


= 


https: //blogger .googleusercontent .com/img/a/AVvXsEj0JSv23_-EhpZavVbBeTY9IEt9XTNTxBrk7pIBCV5ZK_Fe5tB5eLisi 
OghrWRvNpUP3G37nqg3stgVoEISM4ROr jC5jx4idnOuU6ax5Bct5G4 


ttps://blogger .googleusercontent .com/img/a/AVvXsEiWzK9cL013GEpIqk16r9jPi-ApBlsEDrOTVJHYm_enZ7DLYFCwKBF5Ai 
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> 


e17ZdQ JySZ-zQGDhm6f vqFN7i9kngog63leomFT776HJST4j6Lso 
. https: //blogger . googleusercontent .com/img/a/AVvXsEiREoaLWjdpwe2watCE9kMYOtZFy1oRQJ_SOASR4- eeoq5yKBP4RNKOEs 


Xe) 


0. 


pay 


1.2.3 Profiling the Internet Connected Infrastructure of the Genesis Market 
Cybercrime-Friendly Online Marketplace (2023-04-06 23:43) 


[1] 
ese ro san 
 - 
; qs, 
° ~—_ 
Mezina Svatiana g3n3sis.org g3n3sis.pro 


g3n3sis.me 


@) 
genesis, market 


Dear blog readers, 


I’ve decided to take a deeper look inside the Internet connected infrastructure of the recently 
seized Genesis Market cybercrime-friendly marketplace with the idea to provide actionable 
intelligence and to assist vendors organizations and researchers including U.S Law Enforcement 
on its way to properly track down and monitor the cybercriminals behind these campaigns. 


Related Genesis Market domains: 
hxxp://sync[.]genesis-update[.]net 
hxxp://sync[.]genesis-security[.]net 
hxxp://g3n3sis[.]pro 
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hxxp://xmpp[.]genesis[.]market 
hxxp://genesis[.]marjet 
hxxp://g3n3sis[.Jorg 
hxxp://sync[.]gsconnects[.]Jcom 
hxxp://g3n3sis[.]org 
hxxp://g3n3sis[.]pro 
hxxp://g3n3sis[.]me 


Sample IPs known to have been involved in the campaign include: 


¢ 195[.]206[.]181[.]217 


hxxp://sync.genesis-update.net 
hxxp://sync.genesis-security.net 
hxxp://g3n3sis.pro 
hxxp://xmpp.genesis.market 


° 89[.]44[.]9[.]110 


hxxp://genesis.marjet 
hxxp://g3n3sis.org 
hxxp://sync.gsconnects.com 


° 89[.]42[.]212[.]194 
° 163[.]172[.]125[.]48 


hxxp://genesis.marjet 
hxxp://g3n3sis.org 
hxxp://sync.gsconnects.com 
Sample related domains: 
hxxp://softexpertupdate.com 
hxxp://cms.softexpertupdate.com 
hxxp://179.43.157.79.mywebccon.us 
hxxp://seed.bitcoinstats.com 
hxxp://dnsseed.bluematt.me 
hxxp://psql04.exoffer.net 
hxxp://pornnhub.net 
hxxp://status.softexpertupdate.com 


hxxp://www.exoffer.net 
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hxxp://portal.softexpertupdate.com 
hxxp://server.softexpertupdate.com 
hxxp://www.softexpertupdate.com 
hxxp://mysql.softexpertupdate.com 
hxxp://nationalcasino-pl.org 
hxxp://g3n3sis.pro 
hxxp://sync.genesis-security.net 
hxxp://g3n3sis.org 
hxxp://www.pornnhub.net 
hxxp://mail.pornnhub.net 
hxxp://vps.pornnhub.net 
hxxp://ww1.pornnhub.net 
hxxp://ftp.pornnhub.net 
hxxp://vpn.pornnhub.net 
hxxp://mx.pornnhub.net 
hxxp://app.pornnhub.net 
hxxp://hostmaster.pornnhub.net 
hxxp://sync.genesis-update.net 
hxxp://remote.pornnhub.net 
hxxp://server.pornnhub.net 
hxxp://stage.pornnhub.net 
hxxp://citrix.pornnhub.net 
hxxp://email.pornnhub.net 
hxxp://files.pornnhub.net 

Sample IPs: 


° 179[.]43[.]157[.]79 


hxxp://exoffer[.]net - Email: lisadaleyOO24@gmaill[.]Jcom 


hxxp://softexpertupdate[.]com - Email: proprivxx@rambler[.]ru 
¢ 179[.]43[.J157[.179 


hxxp://pornnhub[.]net - Email: mertvural@mynet[.]com; vuralmert@mynet[.]com 
hxxp://exoffer[.]net 

hxxp://123nextgift[.]Jcom 

hxxp://update-flash[. ]net 
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hxxp://recallsystem[.]net 
hxxp://flash-update[.]net 
hxxp://k7mM58z65g32t[.]net 


hxxp://filesbase[.]Jnet - Email: aleksei[.]Jrqobakov@maill[.Jru| - hxxp://realstatistics[.]info; 
hxxp://webstatisticspro[.]net 


hxxp://softexpertupdate[.]com 
hxxp://pornnhub[.]net 
Dots dots dots. We’ve already got the aleksei.rqbakov@mail.ru email profiled [2]here. 


Sample screenshots include: 
[3] 


®) 


filesbase net 


@ 


alekse| tqbakov@mail.ru 


© © 


tealstatistios.info webstatisticspro.net 


[4] 
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@ @ 


lisadaley0024@gmail.com propreogrambierru 


r I + 


sonexpantupdate com pormnnub.net Itesbase net 
’ ’ ’ r ¥ 7 
1 23nextgif.com exoffer net flastyupdate net kh? mS8z65g32tnat update-fash net 


, 


fecallsystam net 


[5] 


iw 


89.42. 212.194 


= 8 2B 


g3n3sis.pro www.genesis.market genesis:market xMpp.genesis.market 
& a ‘ “ 
g3n3sis.carg WWW,g3n3sis.org Www.03n3sis.me g3n3sis,me 


r 


syne.genesis-securitynet sync.genesis-update.net 


Stay tuned! 
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1 
2. https://www.forcepoint .com/blog/x-labs/uncovering-malicious-traffic-direction-system-blackhat-tds 

3 
| 
| 


ul 


1.2.4 Exposing a Currently Active Domain Portfolio of E-Shops for Stolen Credit 
Cards Information (2023-04-10 12:10) 


Dear blog readers, 


I’ve decided to share with everyone a set of upcoming blog posts on the market for E-Shops 
for stolen and compromised credit card details with the idea to raise everyone’s awareness on 
the topic and the proliferation and easy to use and launch E-Shops for stolen and compromised 
credit card details. 


Sample personally identifiable email address accounts known to have been involved in the 
campaign include: 


MSMAZEVEDO@GMAIL[.]COM 
imakoos85@gmail[.]Jcom 
kang[.]hr[.Jig@gmail[.]com 
powerdavel@gmail[.]Jcom 
lunaritsolution@outlook[.]com 
ajewoletimmy@gmail[.]com 
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saarsoftware@gmail[.]com 
bluetextmama@gmaill[.]Jcom 
ea1l958@gmail[.Jcom 
enguyen[.]fr@gmail[.]Jcom 
Sample responding IPs known to have been involved in the campaign include: 
47[.]74[.]137[.]231 
47[.174[.]235[.]179 
27[.]102[.]128[.]164 
149[.]129[.]136[.]150 
92[.]38[.]135[.]251 
47[.174[.]177[.]133 
46[.]21[.]248[.]49 
47[.174[.]236[.]158 
62[.]76[.]44[.]254 
47[.]52[.]233[.]0 
194[.]147[.134[.182 
209[.]99[.]40[.]226 
195[.]2[.]67[.]107 
45[.]153[.]230[.]30 
185[.]240[.]103[.]226 
185[.]14[.]30[.]108 
5[.]188[.]89[.]85 
54[.]197[.]O[.J101 
92[.]38[.]160[.14 
188[.]166[.]32[.]65 
47[.]74[.]176[.]64 
92[.]242[.]40[.]127 
185[.]217[.]199[.]57 
95[.]181[.]157[.]180 
161[.]117[.17[.]46 
149[.]129[.]226[.]244 
209[.]99[.]40[.]227 
47[.]52[.]142[.]249 
95[.]161[.]129[.]77 
35[.]180[.]38[.]166 
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91[.J225[.]216[.16 
193[.]187[.]175[.]159 
149[.]129[.]240[.]26 
88[.]119[.]179[.]216 
149[.]129[.]215[.]190 
172[.]67[.J223[.]35 
47[.]74[.]184[.]97 
49[.]51[.]85[.]205 
18[.]118[.]254[.]174 
46[.]173[.]214[.]200 
91[.]227[.]18[.]166 
192[.]3[.]80[.J115 
47[.]88[.]158[.]202 
45[.]153[.]73[.]8 
185[.]203[.]240[.]80 
185[.]159[.]129[.]106 
104[.]18[.]46[.]127 
172[.]67[.]195[.]158 
104[.]18[.]37[.]112 
188[.]114[.]99[.]128 
104[.]21[.]36[.]194 
104[.]18[.]36[.]112 
172[.]67[.]198[.]196 
172[.]64[.]87[.]81 
188[.]114[.]96[.]3 
104[.]21[.]79[.]214 
188[.]114[.]97[.]14 
172[.]64[.]92[.]205 
20[.]102[.]115[.]223 
176[.]119[.]156[.]198 
78[.]155[.]207[.]76 
47[.]254[.]213[.]246 
95[.]181[.]179[.]111 
47[.]88[.]156[.]38 
91[.]203[.]192[.]138 
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27[.]102[.]102[.]120 
193[.]70[.]95[.]200 
188[.]114[.]96[.]14 
213[.]183[.]61[.]45 
104[.]24[.]118[.]30 
92[.]38[.]135[.]185 
172[.]67[.]138[.]127 
188[.]114[.]96[.]9 
146[.]112[.]61[.]107 
172[.]67[.]135[.]89 
104[.]24[.]119[.]30 
188[.]114[.]97[.]15 
192[.]42[.]118[.]104 
172[.]67[.]184[.164 
88[.]119[.]179[.]132 
A7[.174[.]176[.]216 
194[.]53[.]111[.]251 
185[.]180[.]231[.]7 
13[.]57[.]17[.]224 
104[.]31[.]76[.]164 
149[.]129[.]216[.]197 
198[.]105[.]254[.]11 
104[.]31[.]77[.1164 
34[.]209[.]208[.]254 
91[.]92[.]144[.]15 
104[.]21[.]32[.]66 
52[.]26[.]159[.]124 
104[.]21[.]52[.]206 
172[.]67[.]203[.]167 
104[.]24[.]97[.]90 
A6[.121[.]249[.]114 
95[.]213[.]2031.]64 
104[.]24[.]96[.]90 
149[.]129[.]219[.123 
85[.]119[.]150[.]155 
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134[.]122[.]46[.]76 
46[.]173[.]215[.]186 
91[.]203[.]192[.]190 
192[.]3[.]161[.]183 
34[.]98[.]99[.]30 
176[.]107[.]160[.]148 
45[.]143[.]136[.]148 
142[.]93[.J122[.]253 
89[.]32[.]41[.]139 
194[.]67[.]71[.]134 
176[.]124[.]193[.]77 
150[.]109[.]48[.]71 
185[.]244[.]183[.]252 
45[.]143[.]137[.]41 
95[.]213[.]252[.]3 
18[.]220[.]144[.]78 
161[.]117[.]12[.]56 
185[.]233[.]0[.]27 
46[.]148[.]113[.]207 
109[.]70[.]26[.]37 
91[.]194[.]3[.]84 
185[.]224[.]212[.]28 
193[.]187[.]128[.]22 
92[.]38[.]135[.]250 
94[.]250[.]252[.]7 
185[.]224[.]212[.]29 
91[.]203[.]193[.]132 
194[.]67[.]71[.]93 
185[.]212[.]129[.]246 
5[.]178[.]2[.]230 
92[.]53[.]77[.]40 
185[.]241[.]54[.]112 
92[.]242[.]40[.]199 
34[.]219[.]55[.]209 
2[.]57[.]187[.]160 
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141[.]98[.]134[.]31 
213[.]189[.]219[.]6 
192[.]162[.]246[.]117 
213[.]59[.]127[.]192 
104[.]18[.138[.]216 
185[.]93[.]109[.]250 
78[.]155[.]206[.]161 
62[.]75[.]207[.]166 
195[.]140[.]147[.]9 
91[.]142[.]78[.]202 
95[.]181[.]157[.]128 
91[.]199[.]147[.]94 
45[.]156[.]119[.]4 
92[.]53[.177[.]90 
176[.]124[.]193[.]25 
44[.]192[.]59[.170 
23[.]147[.]229[.]205 
193[.]187[.]175[.]33 
194[.187[.]101[.]3 
45[.]85[.]117[.]104 
194[.]85[.]61[.]76 
62[.]77[.]154[.]3 
195[.]123[.]221[.]141 
193[.]187[.]174[.]103 
127[.]O[.JO[.]1 
104[.]24[.]112[.]44 
91[.]203[.]193[.]176 
193[.]187[.]175[.]104 
194[.]147[.]35[.]176 
47[.]254[.]201[.]251 
5[.]178[.]2[.]98 
94[.]130[.]10[.]95 
Related domains known to have been involved in the campaign include: 
hxxp://approved-cc[.]ru 
hxxp://approved-shop[.]be 
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hxxp://approved-shop[.]su 
hxxp://approved[.]moscow 
hxxp://approvedbazar[.]ru 
hxxp://bases-valid[.]com 
hxxp://bazar-vclub[.]su 
hxxp://bingodumps[. ]ru 
hxxp://cardcase[.]ru 
hxxp://carderbasesu[. ]ru 
hxxp://carderprofit[. ]p| 
hxxp://cardershop[. ]pl 
hxxp://carderstore[.]su 
hxxp://cardersvilla[.]Jru 
hxxp://cardhouse[.]be 
hxxp://carding-forumcc[. ]ru 
hxxp://carding-world[.]Jcom 
hxxp://cardingcvv[.]p! 
hxxp://cardingcvv[.]su 
hxxp://cardingforums[.]su 
hxxp://cardingmaestro[.]com 
hxxp://cardingpro[.]ru 
hxxp://cardmafial.]ru 
hxxp://cardsmarket[.]su 
hxxp://cardstorm[.]su 
hxxp://cardvilla[.]p!| 
hxxp://cc-shop[.]me 
hxxp://cc-shop[.]pl 
hxxp://cc-stock[.]su 
hxxp://ccclc[.]ru 
hxxp://ccfullz[.Jsu 
hxxp://ccfullzshop[.]su 
hxxp://ccshoponline[.]lorg 
hxxp://ccstores[.]Su 
hxxp://ccvv2dumps[.]com 
hxxp://centralshop[. Jim 


hxxp://centralshop[.]moscow 
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hxxp://cf[.]myrecensionil. Jit 
hxxp://charlotteshop[. ]tk 
hxxp://cheapcvv[.]su 
hxxp://chinadump[.]ru 
hxxp://cvs[. ]ripcc[.]ru 
hxxp://cvv-fresh-shop[. ]ru 
hxxp://cvv-seller[.]ru 
hxxp://cvv-shop[.]cc 
hxxp://cvv-shop[.]pl 
hxxp://cvv2shop[.]me 
hxxp://cvv2u[.]su 
hxxp://cvvbank[. ]ru 
hxxp://cvvcarders[.]com 
hxxp://cvvdump[.]com 
hxxp://cvvforsale[.]com 
hxxp://cvvlist[. info 
hxxp://cvvme-shop[.]me 
hxxp://cvvonlineshops[.]com 
hxxp://cvvshop39[.]su 
hxxp://cvvshoponline[. ]ru 
hxxp://cvvshops[.]su 
hxxp://cvvunion-cvv[.]su 
hxxp://cvvunion-store[.]su 
hxxp://cvvunion[.]me 
hxxp://d4rksys[.]ru 
hxxp://dark-sell[.Jru 
hxxp://darkcarders[. ]ru 
hxxp://darkteam[.]ru 
hxxp://dump-shop[. ]pl 
hxxp://dump99[.]com 
hxxp://dumps247[.]su 
hxxp://dumps4free[.]ru 
hxxp://dumpsbuycvv[.]com 
hxxp://dumpscenter[.]name 
hxxp://dumpscvv2[.]net 
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hxxp://dumpshop[. online 
hxxp://dumpskingdon)[. ]biz 
hxxp://dumpsmall[.]Jname 
hxxp://dumpsshop[. ]p! 
hxxp://dumpsvendor[.]su 
hxxp://dumpswithpin[. Ip! 
hxxp://golddumps[.]net 
hxxp://goldplastic[.]store 
hxxp://gooddumpsl[. ]ru 
hxxp://gorod-grekhov[.]su 
hxxp://gownscode[.]com 
hxxp://greatdump[. Jru 
hxxp://greatdumps[.]net 
hxxp://greatdumpsshop[. Jru 
hxxp://greatdumpz[.]ru 
hxxp://gsp[.]mptc-store[.]de 
hxxp://gttrendsvideo[.]cf 
hxxp://gullashop[. ]ru 
hxxp://cvv-store[. ]ru 
hxxp://allworld-cc[.]ru 
hxxp://altenen-forum[. Jru 
hxxp://altenens[.]ru 
hxxp://approved-bazar[.]su 
hxxp://bulletproof-hosting[.]su 
hxxp://cardmarket[.]su 
hxxp://crdsu-forum[.]su 
hxxp://cremecreps[.]su 
hxxp://cvv2-shop[.]ru 
hxxp://cvv2[.]in 
hxxp://cvv3[.]ru 
hxxp://daymart[.]co 
hxxp://deluxedumps|[.]su 
hxxp://diamondumps[.]net 
hxxp://doomday[.]ru 


hxxp://dragonara[.]su 
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hxxp://fastflux[.]su 
hxxp://feshop-reserve[.]com 
hxxp://freshbay[.]pl 
hxxp://fullzinfo[.Jru 
hxxp://hygienely[.]com 
hxxp://jokerstash[.]club 
hxxp://jshop-com[.]ru 
hxxp://masttatoo[.]com 
hxxp://mejorespaginasdecitas[.]xyz 
hxxp://n-perspektival[.]ru 
hxxp://pinkshop[.]info 
hxxp://riclub[.]ru 
hxxp://serferio[.]ru 
hxxp://shopcvvdumpsl. Jru 
hxxp://snakeshophk{. Jru 
hxxp://storecvv[.]ru 
hxxp://tuneshop[. ]su 
hxxp://undef-cvv[.]su 
hxxp://undefinfol[.]su 
hxxp://uniccfreecc[.]ru 
hxxp://validccseller[. ]p| 
hxxp://validmn[.]ru 
hxxp://validms-store[.]ru 
hxxp://vclub-shop[.]su 
hxxp://yalelodge-cm[.]ru 
hxxp://yourmoney24[.]ru 
hxxp://hackforum[.]su 
hxxp://crdshop[.]be 
hxxp://approvedbazar-market[.]su 
hxxp://nhoneymoney[.]su 
hxxp://bestvacancyl.]ru 
hxxp://acc-sell[.]ru 
hxxp://shopbuycvvwithpaypall.]ru 
hxxp://shop-credit-card-dumps-reddit[. ]ru 
hxxp://shop-cvv-shop-2019[.]ru 
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hxxp://shop-uni-cc-shop[. ]ru 
hxxp://darkmarket[.]su 
hxxp://ccheaven[.]org 
hxxp://lulzsec[.]ru 
hxxp://forumcarder[.]com 
hxxp://valid-shop[.]Jcom 
hxxp://bestbins[.]ru 
hxxp://braindumps[.]su 
hxxp://ccreviews[.]Su 
hxxp://allcarders[. ]ru 
hxxp://allotrope[.]hotspotproxy[.]xyz 
hxxp://allworld-cards[. ]ru 
hxxp://altenen[.]su 
hxxp://antispam[.]7vkontakte[.]ru 
hxxp://apache[.]novlops[.]Jcom 
hxxp://apache[.]wwwI[.]ktmstore[.]su 
hxxp://apil.]lriccardo[.Jcom 
hxxp://apps[. ]foto-golie-tela-devochek[.]cvvshop1[.]su 
hxxp://apps[.]wwwI[.]c4c[.]Jsu 
hxxp://appsman[. ]xyz 
hxxp://argovpnfalconn[.]gq 
hxxp://artisticimpressionsuk[.]com 
hxxp://atcarpul[.]gq 
hxxp://atomstroy[.]net 
hxxp://auto-vils[.]ru 
hxxp://avantprojects-gh[.]com 
hxxp://awhf9[.Judbbup[.]Jcom[.]cn 
hxxp://b-hls-05[.]strpst[.]Jcom 
hxxp://bankomat[.]be 
hxxp://barbican[. ]tv 
hxxp://barracuda[.]7vkontakte[.]ru 
hxxp://before[. Jinatticlarijf[.]cf 
hxxp://bgptools-wildcard-confirmed[.]googbarunfe[.]ml 
hxxp://bgptools-wildcard-confirmed[.]xn-80abewf6ayd1f[.]xn-plai 
hxxp://bigfat[.]cz 
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hxxp://bilaushop[.]me 

hxxp://bins[.]group 

hxxp://bitz-exchangel[.]Jcom 

hxxp://bl3ndal[.]se 

hxxp://blog[. Jilimit[.Jes 
hxxp://bnro[.]altronik-planet[.]ru 
hxxp://briansclub[.]ru 

hxxp://brocard1[.]com 

hxxp://brocard1[.]ru 

hxxp://brutal55[.]Jcom 

hxxp://bs[.]a3-sport[.]ru 

hxxp://buybanklogin[.]ru 

hxxp://buyccfullz[.]ru 

hxxp://buycvv[. ]pl 

hxxp://ouycvvdumps[.]ru 
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hxxp://www[.]europackersmovers[.]com 
hxxp://wwwl[.]fastflux[.]su 
hxxp://www[.]fatherdeall[.]ru 
hxxp://wwwl.]fbdpp[.]cn 
hxxp://wwwI[.]fe-dumps[.]ru 
hxxp://wwwl.]fedumps-web[.]ru 
hxxp://www[.]feshop-jet1[.]ru 
hxxp://wwwl[.]freshbase[.]su 
hxxp://wwwl[.]gaical.]ru 
hxxp://wwwl[.]geek-mods[.]su 
hxxp://www[.]goldendrakon[. ]ru 
hxxp://wwwl.]hbcd[.]gzni[.]science 
hxxp://wwwI[.]health-fitness[.]co[.]uk 
hxxp://wwwl.]hnvh[.Jcmbcwebdesign[.]co[.Juk[.]Jcdn[.]c loudflare[.]net 
hxxp://wwwI[.]hubtactics[.]Jcom 
hxxp://wwwl[.]independentreserve[.]biz 
hxxp://wwwl[.]Jironcash24[.]ru 
hxxp://wwwl[.]ironcash24[.]su 
hxxp://wwwl.]jacquelinemercerjewelry[.]com 
hxxp://wwwI[.]jianliu[.Jcom 
hxxp://www[.]jstash-bazar[.]moscow 


hxxp://wwwI[.]key-norton[.]Jcom 


hxxp://wwwl.]king11[.]net 

hxxp://wwwl.]king11[.]ru 

hxxp://wwwl.]kurupt[.]cc 
hxxp://wwwl[.]lizardlabs[. Jorg 
hxxp://wwwl[.]Jlorenzopavia[.]Jcom 
hxxp://wwwl[.]magento2[.]admin[.]reinelinjer[.]no 
hxxp://wwwl[.]magento[. ]citrixgateway[.]reinelinjer[. Jno 
hxxp://wwwl[.]marcelolopes[. Jjor[.]br 
hxxp://wwwl[.]mc-source[.]ru 
hxxp://wwwl[.]megamanial[.]su 
hxxp://wwwl[.]menfo[.]ru 
hxxp://www[.]n1shop-cc[.]com 
hxxp://wwwl[.]n1shop[.]net 
hxxp://wwwl[.]nesaclinic[.]com[.]cdn[.]cloudflare[.]net 
hxxp://www[. ]nettomarket[.]ru 
hxxp://wwwl[.]online-cvv[.]ru 
hxxp://wwwl[.]parfumpapal. ]ru 
hxxp://wwwl[.]privateshop2[.]Jcom 
hxxp://wwwl[.]rdp-shOp[.]su 
hxxp://www[.]romanticstihil.]ru 
hxxp://wwwl[.]royaldumps[.]shop 
hxxp://wwwl[.]saikonred[.]top 
hxxp://www[.]sampgafesal[. ]tk 
hxxp://www[.]seks-porno-lizhutsya-muzhiki[.]rescator[.]su 
hxxp://www[.]shop-carder-cvv[. ]ru 
hxxp://wwwl[.]simplenews[.]ru 
hxxp://www[.]skizdumps[.]su 
hxxp://wwwl[.]soblaznila-malchika-porno-video[. ]livefire[.]su 
hxxp://wwwl[.]sosyopix[.]com 
hxxp://wwwl[.]sounic[.]ru 
hxxp://www[.]stardumps24[.]su 
hxxp://wwwl[.]storecc[. ]pl 
hxxp://wwwl[.]takeitdumps[. Jru 
hxxp://wwwl[.]track2-shop[.]ru 
hxxp://wwwl[.]trump-dmps[.]su 
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hxxp://wwwl[.]try2services-cc[.]su 
hxxp://wwwl[.]try2services-vc[.]su 
hxxp://wwwl[.]uggitalia[.]site 
hxxp://wwwI[.]uni-ccshop[.]su 
hxxp://wwwI[.]unicctordomain[.]ru 
hxxp://www[.]Juniteddumps[.]ru 
hxxp://wwwI[.]utovokzal62[.]ru 
hxxp://wwwI[.]valid-dumpshop[.]ru 
hxxp://wwwI[.]validshop[.]be 
hxxp://wwwI[.]vclubshop-shops[. ]su 
hxxp://wwwl.]vppz[.]ru 
hxxp://wwwl[.]writunaninun[. ]tk 
hxxp://wwwl[.]yalelodgecm[.]su 
hxxp://wwwI[.]zr2v[.]cqx 
hxxp://wwwI[.]zx-kan[. ]top 
hxxp://xingjizugiubocaiwang[.]s13[.]Jlanlanboke[.]Jcom 
hxxp://xmlI[.]rpsolutions[.]cc 
hxxp://xn-spIlmaschinen-men-kzbo[.]de 
hxxp://yonwf[.]|2wil.]Jorg 
hxxp://yotel-dellenazioni-rome[.]com 
hxxp://yyax[.]caikondd[.]cn 
hxxp://zhenskie-krossovki-nike-magazin-v-moskve[.]thaddu[.]com 
hxxp://zmail[.]fursin[.]untembe[.]com 
hxxp://zrgr8rs85[.]biz 
hxxp://validcardersforum[. ]ru 
hxxp://yalelodge-market[.]ru 
hxxp://paypalshop[.]su 
hxxp://cvvshop1[.]su 

hxxp://fuls[.]su 
hxxp://dumps-bin[.]com 
hxxp://darktools[.]ru 
hxxp://dumps-reliable[. ]ru 
hxxp://fresh-cvv-shop[.]ru 
hxxp://heaven-shop[.]com 


hxxp://freshstore[.]su 
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hxxp://backstab[.]su 
hxxp://cvvsale-shop[. ]ru 
hxxp://try2swipe[.]su 
hxxp://unicvv-ru[.]su 
hxxp://powerdumps[.]su 
hxxp://lampeduza[.]su 
hxxp://allworld-store[.]su 
hxxp://shoponline-dumps[. ]top 
hxxp://ccguru[.]Su 
hxxp://blackcc[.]net 
hxxp://cvv-seller[.]su 
hxxp://mkdumps[.]Jcom 
hxxp://approvedcc[.]ru 
hxxp://carderscave[.]su 
hxxp://2tracks[.]biz 
hxxp://cvvshopvalid[.]ru 
hxxp://dumps[.]moscow 
hxxp://crdpro[.]net 
hxxp://cardshop[.]su 
hxxp://cvvshopverified[.]top 
hxxp://fullzshop[. ]pl 
hxxp://mail[.]redselo[.]ru 
hxxp://russiancarders[.]su 
hxxp://biz[.]nsc-monolit[.]ru 
hxxp://dailyupdate[.]su 
hxxp://megadumps[.]su 
hxxp://stdumps[.]su 
hxxp://grmtech[.]net 
hxxp://validcard[.]su 
hxxp://shop-cvvunion[.]ru 
hxxp://voltstore[.]biz 
hxxp://cc-shop[.]su 
hxxp://valld[.]ru 
hxxp:/skizdumpsl[.]su 
hxxp://web-hack[.]su 
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hxxp://rescator[.]Su 
hxxp://spam-market[.]su 
Stay tuned! 


1. https: //blogger .googleusercontent .com/img/a/AVvXsEiiHOxyz3mctOcqaMgMRKKN_poabppCPpyVr-BEU5oHN2WYmVphEQJF4 
Kjexr IEHgxdRARz-HJ91ZYCfmcY/7BjUuiWoi72NfXhkPoOtKOuma2 


1.2.5 Profiling the Internet Connected Infrastructure of the Genesis Market 
Cybercrime-Friendly Online Marketplace - Part Two (2023-04-10 12:11) 


[1] 


@ 


jose@webcontrolmultimedia.com 


® 


activosenrenta.com ymcontrol.com spainsfain.com 


®) 


® © © 


ipeontrol.ora pingcontrol.com fatagallery.net 


© © 


tracecontral net clavedifusa.com 


Dear blog readers, 


I’ve decided to dig a little bit deeper inside [2]Genesis Market’s Internet-connected infrastruc- 

ture for the purpose of providing vendors researchers and organizations including U.S Law En- 

forcement with additional insights into the Internet-connected infrastructure of the cybercrime- 

friendly forum marketplace. 

As | was able to find several other related domains known to have been affiliated in 

the campaign both currently and historically I've managed to track down and connect 
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the dots between the currently active Genesis Market Internet-connected infrastructure 
and a well known traffic acquisition hijacking and management for malicious purposes 
campaign ([3]aleksei.rqbakov@mail.ru) including a (hxxp://applyinfo[.Jorg) - [4]DarkHotel 
Cyber Espionage related email (hxxp://anteph[.Jorg) - [5]PushDo malware campaign affili- 
ated email (hxxp://darkhero[.Jorg) - [6]Threat Group 3390 Cyber Espionage related email 
(hxxp://googmail[.Jorg) - [7]Uyghur Targeted Malware campaign related email (hxxp://update- 
onlines[.Jorg) - [8]Threat Group 3390 Cyber Espionage related email. 


Here are all of Genesis Market’s primary domains: 
hxxp://tracecontrol[.]net 

hxxp://genesis-security[.]net 

hxxp://gsconnects[.]com 

hxxp://g3n3sis[.]net 

hxxp://approveconnects[.]Jcom 
hxxp://genesis-update[.]net 

hxxp://g3n3sis[.]su 

hxxp://gen2dev[.]net 

hxxp://tracecontrol[.]Jnet - Email: jose@webcontrolmultimedial.]com 
Related domains: 

hxxp://clavedifusa[.]Jcom 

hxxp://tracecontrol[.]net 

hxxp://ipcontrol[.Jorg - Email: snowyowl@jpnsec[.]Jcom 
hxxp://spainsfain[.]Jcom 

hxxp://fatagallery[.]net 


hxxp://pingcontrol[.Jcom - Email: gherasim@gherasin[.]net; CUSTOMERSER- 
VICE@RECWEAR[.]COM 


hxxp://vmcontrol[.]com 
hxxp://activosenrenta[.]com 
Related domains: 
snowyowl@jpnsec[.]Jcom - 


anteph[.Jorg - Email: michellewmowbray@jourrapide[.]Jcom; © compacx@gmail[.]com; 
put[.Ja[.]feud[.]pike011235@gmail[.]Jcom; compac@vianw|[.]pta 


applyinfo[.Jorg - Email: gerben _habets@163[.]Jcom 

darkhero[.]org - Email: ykcaihyl@163[.]Jcom; dddd@aoll[.]com 

googmaill.Jorg - Email: xsldmt@xj163[.]cn; cmickler@mpi-klsb.mpg[.]de 
update-onlines[.Jorg - Email: working success@163[.]com 

Related email address accounts known to have been used in the campaign include: 
michellewmowbray@jourrapide[.]com 

compacx@gmail[.Jcom 
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put[.Ja[.]feud[.]pike011235@gmail[.Jcom 
compac@vianwl[.]pt 

gerben habets@163[.]com 
ykcaihyl@163[.]Jcom 
dddd@aoll[.]Jcom 
xsidmt@xj163[.]cn 
cmickler@mpi-klsb[.]mpg[.]de 
working success@163[.]com 
Related domains: 
hxxp://windows-updateonlines[.]com 
hxxp://xjyqgyl.]Jcom 
hxxp://update-onlines[.]lorg 
hxxp://videototal[.]net 
hxxp://bonitimovell[.]com 
hxxp://wjucil.]Jcom 
hxxp://googmail[.Jorg 
hxxp://anteph[. Jorg 
hxxp://utvsoft[.]com 
hxxp://xjcoop[.]com 
hxxp://yourturbe[.]Jorg 
hxxp://ufoneconference[.]com 
hxxp://websurprisemail[.]Jcom 
hxxp://prehospitalar[.]com 
hxxp://githubs[.]net 
hxxp://centr-info[.]com 
hxxp://fordae[.]Jcom 
hxxp://compac[.]org 
hxxp://darkhero[. Jorg 
hxxp://blackcmd[.]com 
hxxp://xjotwy[.]com 
hxxp://applyinfo[.Jorg 
hxxp://Inip[.]org 
hxxp://hotmail-onlines[.]com 
Related MD5s: 
c37e425ab2366aabb29bdf1f60e83c44 


467 


dlebbf32300714fd23f16185719ab473 
d7cf0d1616baa3060d1dbf8fcf411671 
9045590085f6f7aa4f0ea54b7f7e984e 
2¢6633d4742c48fcfb73f570389f0d47 
d8db244325ab164e15adb9al160ff2c2a 
c8c169500721e61600ea5e062b3f2bc1 
bb103a7b1862c3fd80540b0e34af932d 
2d89597e896acb68fa7eec31a2760a23 
9821cb7495d27f2d3294056d4bcd5a0f 
07901d628998cac067c502309336e4ea 
bd1578145c717fff719593b54bf58839 
2a3321754286c94e361f082df1a58374 
95ee6379cb6e3d582f961f2948ceab51 
6cf93258d26080abd9390ba0fe047a91 
53bbf30a0a7beb37f6bcc533e261160b 
931c3a69f93bbd77d6a117a909d0dalf 
gherasim@gherasim[.]net - 
hxxp://ptchotels[.]com 
hxxp://e-tops[.]com 
hxxp://cavhosting[.]Jcom 
hxxp://cavhosting[.]Jorg 
hxxp://gherasim[.]lorg 
hxxp://coonnet[.]org 
hxxp://netallow[.]com 
hxxp://coonnet[.]net 
hxxp://mouseb[.]com 
hxxp://mouseh[.]com 
hxxp://netallow[.]org 
hxxp://pingcontrol[.Jorg 
hxxp://ptcvoucher[.]com 
hxxp://gherasim[.]net 
hxxp://cavsystems[.]org 
hxxp://cavsystems[.]net 
hxxp://jsay[.]net 

hxxp://netallow[.]net 

468 


hxxp://coonnet[.]com 
hxxp://pingcontrol[.Jcom 
CUSTOMERSERVICE@RECWEAR[.]COM 
hxxp://numanna[.]us 
hxxp://megaready247[.]com 
hxxp://megaready365[.]com 
hxxp://recleaguetees[.]com 
hxxp://customtshirtscheap[.]com 
hxxp://symmetryrecovery[.]com 
hxxp://mynumanna[.]asia 
hxxp://astakeinzion[.lorg 
hxxp://teamnumannal[.]us 
hxxp://teamnumannal[.]asia 
hxxp://extrafundscapital[.]Jcom 
hxxp://extramittel[.]Jcom 
hxxp://astakeinzion[.]net 
hxxp://210abbeylane[.Jcom 
hxxp://mynumanna[.]us 
hxxp://megareadyfoodstorage|[.]Jcom 
hxxp://megareadygarden[.]com 
hxxp://megareadyfood[.]Jcom 
hxxp://megareadyfoods[.]com 
hxxp://megareadymeals[.]Jcom 
hxxp://megareadystorage[.]com 
hxxp://megareadyhealth[.]com 
hxxp://megareadymeall[.]Jcom 
hxxp://extrafondsen[.]Jcom 
hxxp://wirefastcash[.]com 
hxxp://extrafondi[.Jcom 
hxxp://extrafonds[.]Jcom 
hxxp://yourextrafunds[.]com 
hxxp://promobandit[.]Jcom 
hxxp://extrafundsllc[.]com 
hxxp://veganhockeyboy[.]com 
Related MD5s: 
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f5b80a40b71e398e58aed6d7be113f33 

2cbfd2493b885f916f801532d84cada3 

224f911bf8f7 9dafaa37485bcdd8dd26 

f11b345eca71b40b409dfbc30b645e0b 

83f0351c5fde747e94da2135cc856f8e 

dfcb97a2e9853b5cdfe3d04737540fa8 

9111b9f55f195e2886b7bflcbbe157fc 

Related MD5s: 
eb9127ee4da6199a85ad37dbbc31e950734dccbe99302821a0db70873ff5c8c5 
e8d9c53057524cde5023c7eaeaab657bd24d18a4c7413c707ba74claad48e22c 
ee343e563ac70b7c61d460dc8b8c59313fela212cb756f6757c46d05d29cc43b 
ecaed016f8d7eb5473251b5d08249556ed9f590bf420f537b947727df42bdbca 
e0bde12d823997a90111af6c6ae34962682f1a3f37d088da162a97dce4006976 
e06d1d80e92573cOcfff62f80c60d0d870f11687f4816593a39e3cc65ee6087e 
€69071c17b04b7c0e1378c8ced749d888b1 7a1222c9982055a51led/7a5a2a3f2c 
e3f164bd260eea2d557010139e4ald4addfecd6c86b39009ca7b43b148dd88c4 
f6440701bf6518750afb7607ef0b2d4f589e5382b2501df413feb2caa8a4c5f7 
f5cdba93d6708c64a9ddf46e89fd35a8b14ec8b39d91da44beeb3f8c23f8f3ac 
f6f1587b229addb417b119571e3f563b1513b8a70911b08fb5e56dd13720a3c0 
f6e56acf8c395b2e4104197c021313396b1f8b06e0bdd000a1416ad5166712f5 
efbb6b3d6dd0c8b5604fd331fd8610dd8850d51469c96b746b421fae7941386f 
ee5745b335a2e42267a666b2f6de15237a13f234b3fbc2703fa3071d7d076efd 
f4ba500elafbf2d5510c2bf8cc4be97803144188f50f7fd07f0e51c1f39ba635 
f07916021a7b725c7f4b4ef2bcc4 7affe8354dalce3d2e3e5377688ef5b8991c 
d043f54aafdef07f2a40429ea7a549d0b500d385886ab7d9daa23f409aeea3fd 
cfefd81feb339262d931024138a798ee2e2e36f248d3b35415680521e3dal012 
d506e86ce47aac97e41a8b49a5dc4c410a3d9a8672126407 7a5f47adf5abc26b 
d2f403175d4c92a6c533ffed2ce106c9048abfc2361cb76aa3e4a55claf60ed0 
ca3d9d1058f737c28c59c59f073cb765d114390cd0d2eb50150c18f594d8f20f 
c€91f3b99e822b86a21850c25281443ee01a84f88870632ed76387c391fb7c1a4 
cc74241af99cbb3163d9fbbb47f8724151fd006ea82b1cdf885306b234b8d21F 
cb9a5c7c97f3b258389e165fleed5af27fae8761f9008198c0045a4b8f9011eb4 
de0f791leac41b1fe17d9b9c3678011f2e10faf0aca96599a94efb26c8b7fe3a5 
d8a600c47406a74a7fecaf9ldefcclae2dbcad6ccc001b0907c6c919287c7ae5 
dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e 
470 


de615db896b1108d8a7 7ed1cbb97751c06697cc23a2c300e993667cde4966040 
d5c8abad11880b65c7bb3a0c54dfde9fbb82c1b37f5a607ceb6f6742cbf78e79a 
d588a3a2690e20b2ad007e5315fad49cbbde95bd8dbf0a2b0f935fea21f32a19 
d8670643faadd2a95b8525896e641e0a52d788e7a4b8e17b557f5b219e8af5cO 
d6fafdf23381935d133060f4806bd70balb9alddecbd438157bac36dfa918996 
fe3ee5a4fda0f22c1a65718c3dfe20d69c3b3c02e736e6f12 702fd2ec6679f32 
fab8a1a495d739034aa640e29aec3afbd39b764181ee073c56aa81bb5fef2cbf 
ffcd0f962be910793ace6097f4775aef3cdb028ae838d87b225f0d8193c706d4 
ff6e78dbd87594459e44ff6a8cdef3565103fa6032b66c79fcO5aa9baf047ab6c 
f7d40c87e5e48cf86f39a5a7f71313f7650288be372f6474ce2701e170bcde23 
f7 Ladbbbf50fe122234b0675a7de09af1029e3d12456670bc796421ec55fa299 
f8e697be3720186e1268f6068f7de550d7ab3cac374e46f322cf226119cfac84 
f8763cdee254e54fca27f843a98a73e0d4158d1e16a8b64b578535efd1bf28Ff7 
79e6f32ca08c52e94bab6elf3bbef129f1e116444al1a9f9el1f4f7000e9b0ac436 
65bbfObd8c6elccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e 
088b2838be6e23f5581e949bf21533c617b12cb6e5fc210a91e7c3972bdd4048 
07ab16d65a728b941454ee974cc24bdaa7b77a3dd1fb94dc84fld04cf028a5e3 
095134c4865a3e45735c0c795c029a3ddedf282b84b7fe8c7871fca9c2e6beed 
08d71d9dd47c333d4123b4eba29c289fe2455cc30ea51274d53f3d67d51lael1lf 
048219709d1980f5220be5eacd29cd4776777ce0d0d96cd6f93f46877cb1f4ea 
02fele05ca2f07215863e2a1fb3b5a00964ed07ffa2ddee45cf6ee8afl0aff90 
06b693c2fed892c2202318794f10a893a07dd66e6f6a8a809489e54596ebe5a2 
068885c13a6c12d9bc49516c2683e38c9cd9b206eb7ab420257c449bbe44faeb 
Oe8e8c9da7 7fe5bb038a2fc189b1f3b142b7290409467c6ddc2c2f8b4b0a7 36f 
0de1494f2732972d6a788f38c6442c0924cda8568bf21cb8f7b70e3fla90ee8F 
111d67ec13ea3d357da0ea2f6cf27665cc2ddb468d76f2c881357e/7cedd77c72 
10f99f9876ef9acc8d3e68cf15b5993ed116f46aa4de6lec90edb6bea944e13e 
0976327d8f8751190c619ecc2a73ceca42e083c84518c52099a6laaalf8fe507 
095a3f84debd7481b880016a770c211a793847f61c72499b4702b16fd9666b28 
0a6854535973cefac6e61598806ef1 b8bcf982b4a7eac2d5120b8e8d44636d06 
09c2d25d8d3aal4ab8817b5 750347 7f2f53f7bbc30460d5c01866423233fb7bd 
02c14e0d63ebeef4ce1b39985fce9dff8f0e8c33d09ed9f7d0ea2f446861c123 
0239493645eb3dafcd10700b19b08a928b242a2441e566cf1211c57cd59el14ea 
a3322b8elebd6728eca8848e53351d33918b6bc3e616a40abc761648c76f1c16 
e466f005cdcc5ba42f14369c0148dc52fc699180bfba2f5eaallcea8b0dee0fa 


471 


de222b9d0abf23f167389877d6a495d11d0232b523137b06920593eae55a759c 
160aabd15d0a5f305bc9e6664bb5c6622af22f00882ef1c92afe9fcbdd2bc309 
O0c7de2aa0d28b725e7fd8e33395cd4ad22d97080af148b8cb94364bf79143el1c 
d62ff85e39d8deb759286d85b0c12008aef868eac196eE166894a1b0aab63ae380 
bd0d5592958606e90b946f54 7 3ff652720b685a78bf55b13314ec6a2576d88ea 
dc13049f3b738e814ae2d68814e965b4e76fal65d936d842803bc7b549724b0e 
d7b30c2c3aa6e7313e9d1f576c7ded2b0e6d824eb33a0bfc51bfe76dc4fc7539 
2263eac303e3df68f6caf0d68473c1c2521leedaale62a26b2428db59d3fcfae9 
lafdc11b6a94bfe2cb2e8808a1b57b7562fe01f9daf67f60ea99686753e48d20 
76078813a8cc61d35b70af5e1a23914387a2352516447dbc2767f10116e2d2a2 
27741622ff7b35d0c2616d3ade69fd23a2c58316e0da96c31319a0bdf90efc58 
98680ca9454533c43e1927 1bfff605f6149820f4aa49af788b670b8a5d055508 
95a91be8e27e821bb8d0a032bbda56af24ad3b72da01a025443246867cabcfb8 
9933468292efeb6b2c9d2c8e36bbe818aebe7e46eeb6d7e25a8299b4e90f3ab6 
987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7 
92c0cc5879215255478b3325bee34353090e08337aa61a92506f0498F7907500 
8e35b5b98aed8865cf0d19f56d458415ddb62112d88802d8d0cdee9bf88aa7F5 
94a0a09ee6a21526ac34d4leabf4ba603e9a30c26e6aldc072ff45749dfb1lfel 
9329488ad456177a8536525e4f9ee181b915479a8115045dedfb01ef97cd4179 
a29cba8815bdc0aab28a09cc85a604d0782948c3fb95ee0e2220b1f0b9ea2954 
9e08b0aa35564066e9096481b205db7b52d2fd3e3f82493fd4558e6f5cb2e12a 
a318993ccfb20c1e13b488aa170db8cb4a7c2846d664348e538c1fa6d2b74304 
a2fbo381ec963c13e8791aac2fbod97080ab4fc3d776a80d2272a3624edb99cf8c 
9b68e88576d7b929633b79c994ff4cf445325b18bc67 7abb22d962d8782cc663 
9a5531e8fed2156cdafle166136dcb71be6c25e54bb7e54a3832d5121623b710 
9d5dde5b73464bc057cefe3f3b65cbca4485eeec157b054ddef269cca7cf71f3 
9c389badc989eae409ad6addb887115fa8bf2f13d110f9a4ea9140c6ff7dacOd 
769057d643flae5eb9b593ba646c74c043f3298339500ae6e9991c6ddda3d107 
757f2c62637765cbc8c7b9f5f63ed4ab00f34485f516a66b2a81b4edfb731920 
79175b288ec1c3ce39c6bdde80cd4f161e5827c9fdbe38c56d7c1e17190d3031 
78602029c405408c88448c39440c683d98dff3927819018ef9b7733a5ceb5da0 
73110adcd240b43cf9ffOd9e5fcc4bb4bcfbaa0fa02305fced52ca6056e6a8fe 
6ea585b9e8243929d4cbele2a5elbd5d27e7025e07cb88febdfa26e24db75alb 
756eb52d350b26a0cf1fbf4211b308f5b8dcf51de97384bbd3efa2549f200837 
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b4c0ca382099bdf46583a8c2cb319772d37c02158e42246da87f7f03dfc610cc 
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bcde0e297f94f4473be6c2710599fbb647a51df7b3a74ddb79004b3c9e3a9988 
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2ccef30aa7048da238ae85b8e358db2cdf2a50690c349477f88bcd4701b34671 
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6a502be25b7f6482c2b75d98014402de126eca8b455fe8ca922dd756a7c344c8 
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snowyowl@jpnsec[.]com - 

hxxp://applyinfo[.Jorg - [9]DarkHotel Cyber Espionage related email. 
hxxp://anteph[.Jorg - [10]PushDo malware campaign affiliated email 
hxxp://darkhero[.Jorg - [11]Threat Group 3390 Cyber Espionage related email 
hxxp://googmail[.Jorg - [12]Uyghur Targeted Malware campaign related email 
hxxp://update-onlines[.]org - [13]Threat Group 3390 Cyber Espionage related email 
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Jesus. Jesus or Cyber Jessus or it’s just a mentality? 
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If you can figure out what’s happening here you’ve probably figured out that this is me circa 
2010 trying to get "back to basics" online which in the context of meaning really means 
hard work a lot of socializing and distributing as much thoughts and random notes including 
hard-work driven research as possible to my fellow readers who greatly inspired me to con- 
tinue blogging and doing research on my personal blog including the usual volume of traffic 
that | get here from friends and colleagues from the industry including the U.S Intelligence 
Community and U.S Law Enforcement where it’s my pleasure and an honor to communicate 
my findings and research in my area of expertise to my readers and friends on a daily basis. 


[2] 


If a link is worth a thousand words try the following U.S Secret Server most wanted cybercrimi- 
nal which guess what with no laughing here is [3]AbdAllah one of my favorite Russian Business 
Network affiliates circa "back in the time”. 


[4] 
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Who wants to really help me fund my retirement fund is into collectables and memorabilia 
understands my "big picture" including the "big picture" and has BitCoin and wants to give 
me a hand here in exchange for something really personal which is my personal 20TB personal 
archive files from 2010 when | was on the top of my being popular game up to 2023 present day 
where I’m struggling with paying the bills working on part time OSINT projects? Keep reading. 


Did you know that if you’re a U.S Intelligence Community member doing cyber intelligence 
and possible research and stumble upon a "4PXFIL" or "E9BDJ4PXFIL" marking in terms of an 
email address account there’s a high probability that this is me and several other [5]online 
individuals doing "outsourcing SIGINT" also known as "fourth party exfil" for further campaign 
attribution and actually bothering to publicly "connect the dots" on major and high profile cyber 
attack campaigns where | was proud to participate in a [6]Top Secret GCHQ Program known as 
"[7]Lovely Horse" to monitor hackers online and on Twitter for technological know-how possible 
labeling them as 


[8] 
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— e: . —— 
— ee ro 7 —< 


ae : by. Dancho Danchey. aoe =z 
https: Jiddanchev, blogspot. com 


~ Envait: dancho, HAAchev@htsh: com: = 


~. 


By the way for the record in case you still haven’t reached the online dazzlement stage check 
out the following screenshot and stay tuned for the actual details. The best is yet to come. 


1. 
2, htps: //blogger .googleusercontent.con/ing/b/X29vZ2n1/AVksBi0~2h-UYOy ip INGEV1gaF601 VaxmaniDBivRREBB_x2 
3, ttpa:/ ews secretaervice,gov/investigation/aoatwanted/ayeiioy 

sheet eterso‘e ning D/A a DHE Seg EP 


ttps://www.forbes. “com/sites/firewall/2010/08/06/bbhe~ global-and-project-vigilant-wheres-the-money/ 


i ttps://cryptome.org/2015/02/gchq-lovely-horse-intercept-15-0204.pdf 


7. https://s3.documentcloud.org/documents/1588694/who-else-is-targeting-your-target-collecting. pdf 


8. https: //blogger . googleusercontent . com/img/b/R29vZ2x1/AVvXsEjnTvla8MLAceJFpfdj8SiApa_OAbONoHU6-b9xvuU2Geb00 


9EVTpyzmaCqn JLUyBVc30ANy08Ri0f ewk j JH_ORLYm- owg8emPg4z 


1.2.7 Auctioning Off? Think Twice and Show Your Support! (2023-04-24 18:12) 


<- <by Danctho Danchev a co 
https: diddanchey, blogspot. com 
~-Enait: it:dancho, HAACKee@REsh: com: = 


ar 


Surprise, surprise. 


Guess who’s selling out without being a sellout? 


[1] 
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Although many of you know and remember me from 2010-2013 with my research when | was on 
the top of my research and analysis game today’s harsh reality is that | think that I’m that very 
close to retiring and basically finding another venture to pursue possibly something in the lines 
of corporate cyber security investment portfolio and innovation management where | can be of 
great help where I’m currently busy paying the bills including a loan including to work on part 
time OSINT projects with great success where my primary goal would be to secure a financial 
pension and retirement fund in the context of auctioning off my 20TB personal files archive 
dating back to 2010 and 2023 for collectibles and memorabilia purposes where among my 
primarily long term projects would be to launch a training program in my line of work including 
to write a Second Edition of my personal memoir including to write several upcoming books. 


Stay tuned! 


1. https://blogger.googleusercontent . com/img/a/AVvXsEgpv7vG54wR1J9jE5SCtEmE2eTRGFR_cVrkkQ7VcUK1DrwiFzLRaUyXq- 
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j ZmN j DXP9eRqCvhn8FBKpnVuovGhNBcR9h1z7g5vJog57tM6dgEk8 


1.2.8 Who Has Information on the Bad Guys and Wants to Share it with Me? 
(2023-04-24 19:23) 


[1] 


Submit Files or Messages 


nember, you-are accessing arvice anonymousry) rrovide contact info if you want a response To Ine messaq 


Browse... | No files selected 


Dear blog readers, 


As of today I’m starting to do something that | haven’t really done in ages and probably never 
really did throughout my entire career which is to do my best to assist friends and colleagues 
including the appropriate Law Enforcement parties with research and knowledge on the bad 
guys which in this particular case would be to solicit information from my readers on current and 
emerging cyber threat actors from my readers using a Dark Web Onion which in this particular 
case is: 


[2 ]http://3axk7cmmrvz5ynggt5of2qp5i7ifhfimInavv23ymm7en7ogjxe57jyd.onion 


Here’s what I’m looking for: 


¢ anything related to cyber intelligence in terms of currently active and ongoing campaigns 
including all the associated loCs that you can share and that you think | need to go through 
and work on based on your submission such as for instance raw cyber intelligence details 
on current and ongoing campaigns domains personally identifiable emails MD5s including 
anything that you think and believe might be worth working on in terms of what you’re 
sharing in terms of "processing" and enriching and working on reaching out to the appro- 
priate parties including the proper Law Enforcement parties involved in tracking down and 
prosecuting the cyber criminals behind these campaigns 
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* personally identifiable information on the bad guys which I'll do my best to share with the 
appropriate Law Enforcement party including friends and colleagues who can truly make 
an impact to track down and prosecute the bad guys based on their campaign activity 


Here’s what to expect in exchange: 


¢ always make sure to know that I'll go through all the cyber intelligence loCs personally 
identifiable information on the bad guys malware and exploits serving domains and as- 
sociated MD5s including anything related to my line of work personally and will work to 
enrich and "process" your submission with the utmost professionalism as possible and as 
always. 


Stay tuned! 


1. https: //blogger . googleusercontent. com/img/b/R29vZ2x1/AVvXsEjGSf INfiLB7a14NkplrfcHP5nkKQLLZ8uMprEVexzMd41J0. 
pxFfLGm9xxn7MDX4KICgk35hU- YqnRaJytO5EBiP_iDY8vO0Q5s7dA 
2. http: //3axk7cmmrvz5ynggt 5of 2qp5i7ifhf imlnavv23ymm7 en7 og jxe57 jyd. onion/ 


1.2.9 Happy Holidays From The (Not) Republic of Bulgaria - An Analysis - Part Four 
(2023-04-24 19:24) 


[1] 


[3]Dipshit. 
1. https://linkedin.com/in/yavorkole 


2. https://blogger. googleusercontent.com/img/b/R29vZ2x1/AVvXsEg8DnfvA7NVI gW9BDgrgItOAoAYYxUgNJso5G1QsWSEv2XxCQ 


yAuEbOnq- 1q0j Jt8RZemf3S08c2uKvNLef IR8P6gRVSPY-KYLLSfx 
3. https: //linkedin.com/in/yavorkole 
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1.2.10 Upcoming DVD Training and Educational Research Compilation Release 
(2023-04-27 14:49) 


[1] 


Dancho Da 

A nchey' 
Ultimate pve < 
Compilation - 2022 


“Setting them str r 
heen wma bro has early days of 


Hons | Resear 


com 


ddanchev.blogspot 


https:// 


| wanted to let everyone know that I’m going in deep research mode which means approxi- 
mately countless days of recording what appears to be my first DVD compilation in the context 
of reaching out to my readers and sharing my true story circa the 90’s up to present day where 
I'll do my best to record my idea as soon as possible and publish it [2]here. 


Sample screenshots include: 


[3] 
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Hcho Danchey 
couttimate DVN 


EM straighe . 


human’ ined” mee Carly 


[4] 


oF 


[5] 
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1 
2, hetpe://archive.org/detaile/eddanchey 

3, https: //blogger. googleuserconvent. con/ing/b/ROv22x/AVwKsEiflke_wOLROMhIz42120600g61g00Vh6G0gh,2oPos9TI 
4. https: //blogger .googleusercontent.con/ing/b/826v2x1/AVWXabg, TiwrbOS@Dwt_CKUBECKVivaVvCs2U0#AUQ6w0aVER 
5, hvtps://blogger.googleusercontent.con/ing/b/R29vZ2x1 /AVwisEgdut BOCSL gwnQRULG1Da¥5 0sqs6t0bY@thpdjgi-ez_ BDH 


1.2.11 My Memoir - In Bulgarian (2023-04-27 14:49) 


H 


[1] 


i 
me 


9 


By 
@ 


- 


S Kourpaxtop 6 tort 

& Sie ini a Au ct 10) Sey 

> eA A (eh 
pocerenien#WAaA» ec eewre \ 


20,6 p a 6.08 k ayn 4/ Aw plogm 
hyOgh HH Het oA warn 


qe 

fyhactaan s Crtpoto Cewper 
npoppamMa Fa xKakepu Ha 
Lbputrancko Pasy3nasbane 
LoAAbRpP Ka Hal ~H3IBeE€CTHHA 

670T 3a cH ypHoOcT fF KHGEDp 

AaTakH Bp Cpeta 
"Toea ¢ momefu nab-enuamennun Beacapcexu Ga02ap 


@tecmosdwmuaucade ¢ cdepama NG MeXNUNNeCRA 


Casypnocm™ 


Did you know that | have a [2]memoir [PDF] written in Bulgarian? Did you also known that | 
have a two hours long free [3]audio book [MP3] in Bulgarian? Did you also know that you can 
also freely download my memoir in Bulgarian in various [4]E-Book [ePub] format readers for 
free? 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEiZN9P_H2fnJcOJFyVWnTeMIIt1x6EzYHGtATRItxSrTJ-tQ 
mCL47LQdN74qbwYnsqik3YC300se51kZMT60H6J1GoNqYfrVvRnMA1 


2. https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber 
_Razuznavane_Memoar_02.pdf 


3. https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber 
_Razuznavane_Audio_Kniga_01.mp3 


4. https: //archive.org/details/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar 
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1.2.12 Who Needs or Wants OSINT and Threat Intelligence Training? 


(2023-04-27 14:50) 
ene 
a5 Individuals 


If anyone’s interested in advanced online OSINT and advanced online cyber threat actor profil- 
ing and threat intelligence training both individually or in group feel free to drop me a line at 
dancho.danchev@hush.com to discuss. 


This is the primary Table of Contents for the advanced OSINT training which I can offer: 


Introduction 

¢ Who is Dancho Danchev? 

¢ What are some of my current and future projects? 
¢ Basics of OSINT 

¢ Current State of the Cybercrime Ecosystem 


¢ Novice OSINT Tactics 


Advanced OSINT Tactics 


¢ Fighting Cybercrime in the Context of Using OSINT 


Threat Intelligence Gathering in the Context of Using OSINT 


Technical Collection in the Context of Using OSINT 
¢ Cyber Attack Attribution in the Context of Using OSINT 


Threat Intelligence Enrichment in the Context of Using OSINT 
¢ Cybercrime Research and Enrichment in the Context of Using OSINT 


¢ Practical OSINT Advices 


Case Study on Fighting Cybercrime Using OSINT 


Case Study 


First Case Study 
¢ Second Case Study 
¢ Third Case Study 
¢ Fourth Case Study 
¢ Fifth Case Study 


* Conclusion 
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This is the primary Table of Contents for the advanced threat intelligence training: 


Introduction 

Overview 

Threat Intelligence Methodologies 

Proactive Threat Intelligence Methodologies 

The Future of Threat Intelligence 

Basics of Threat Intelligence 

Current State of the Threat Intelligence Marketplace 
Current State of the Threat Intelligence Ecosystem 

Novice Threat Intelligence Concepts 

Advanced Threat Intelligence Concepts 

Fighting Cybercrime in the Context of Using Threat Intelligence 
Using OSINT in the Context of Threat Intelligence Gathering 


Threat Intelligence in the Context of Using Technical Collection for Cyber Threat Actor 
Attribution Attacks 


Threat Intelligence in the Context of Cyber Attack. Attribution 
Threat Intelligence Enrichment in the Context of Using OSINT 


Cybercrime Research and Threat Intelligence loC (Indicator of Compromise) Enrichment 
in the Context of Using OSINT 


Practical Threat Intelligence Advices 
Case Study on Fighting Cybercrime Using Threat Intelligence 
Case Study 


First Case Study - The Basics of Starting Into Threat Intelligence for Beginners - A Practical 
Case Study 


Second Case Study - Advanced Threat Intelligence Practices Concepts and Methodologies 
- A Practical Case Study 


Third Case Study - Does the "Aggregate and Forget" Methodology Really Work in the Field 
of Threat Intelligence? - A Practical Case Study 


Fourth Case Study - The Basics of Launching and Maintaining and Operating a Company 
Wide Threat Intelligence Program for Beginners - A Practical Case Study 


Fifth Case Study - Advanced Operation and Maintaining of a Company Wide Threat Intelli- 
gence Program for Advanced Users - A Practical Case Study 
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¢ Sixth Case Study - How to Train Your Threat Intelligence Analysts to be Security Industry’s 
and Analytical and Technical Rock Stars? - A Practical Case Study 


¢ Seventh Case Study - How to Convert Your Company Employee Endpoints Into a Dis- 
tributed Threat Intelligence Passive and Active Threat Intelligence Gathering Sensor? - 
A Practical Case Study 


¢ Eight Case Study - How To Convert Your Clients Into a Passive and Active Distributed Threat 
Intelligence Gathering Sensors? - A Practical Case Study 


¢ Ninth Case Study - How to Utilize Public and Proprietary Threat Intelligence Databases for 
Cyber Threat Actor Attribution Campaigns Including Cross Reference and Cross Checking 
of 


¢ Tenth Case Study - How to Enrich Your Company Wide loCs (Indicators of Compromise) 
Using Public and Proprietary Sources and Connect the Dots on a Major Cyber Attack and 
Cyber Threat Actor Campaign 


* Conclusion 


And here’s a sample introduction for the OSINT training which | can offer with the idea to get 
you to know the actual style of the training: 


Basics of OSINT in the Context of Fighting Cybercrime - The Definite Beginner’s Guide 


“What use are they? They’ve got over 40,000 people over there reading newspapers.” - Presi- 
dent Nixon 


This introductory guide into the world of OSINT is part of an upcoming series of articles aiming to 
assist both novice and experienced security practitioners including analysts for the purpose of 
entering the world of OSINT for cybercrime research and aims to offer a high-profile and never- 
published before practical and relevant in today’s nation-state and rogue cyber adversaries 
Internet and cybercrime ecosystem whose purpose general overview and introductory material 
and training course material for novice beginners including advanced Internet users hackers 
security consultants analysts including researchers who are interested in exploring the world 
of OSINT (Open Source Intelligence) for the purpose of making a difference doing their work in 
a better and more efficient way including to actually be fully capable and equipped to catch 
the bad guys online including to monitor and track them down to the point of building the big 
picture of their fraudulent and rogue online activities. The course including the actual learning 
and training material is courtesy of Dancho Danchev who is considered one of the most popular 
security bloggers threat intelligence analysts and cybercrime researchers internationally and 
within the security industry. 


The primary purpose behind this guide is to summarize Dancho Danchev’s over a decade of 
active passive and active including actionable threat intelligence and OSINT research type of 
experience including cybercrime research type of experience where the ultimate goal would 
be to empower the student or the organization taking this course into better doing their online 
research work including to be fully capable of tracking down and monitoring the rogue and 
malicious online activities of the bad guys online where the ultimate goal would be to better 
position and enhance your cyber attack or malicious threat actor cyber campaign attribution 
skills ultimately improving your work activities and actually empowering you to learn how to 
do OSINT for good and most importantly to track down and monitor the bad guys. 


Introduction 
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In a world dominated by sophisticated cybercrime gangs and nation-state sponsored and toler- 
ated rogue cyber actors the use of OSINT (Open Source Intelligence) is crucial for building the 
big picture in the context of fighting cybercrime internationally including to actually “connect 
the dots" in the context of providing personally identifiable information to a closed-group and 
invite-only LE community including international Intelligence Agencies on their way to track 
down and prosecute the cybercriminals behind these campaigns. 


In this training and learning material Dancho Danchev one of the security industry’s most 
popular and high-value security blogger and cybercrime researcher will offer an in-depth peek 
inside the world of OSINT in the context of fighting cybercrime and will provide practical advice 
examples and case in particular on how he tracked down and shut down the infamous Koobface 
botnet and continued to supply never-published and released before potentially sensitive and 
classified information on new cyber threat actors which he continued to publish at his Dancho 
Danchev'’s blog. 


Basics of OSINT 


OSINT in the context of fighting cybercrime can be best described as the systematic and persis- 
tent use of public information for the purpose of building a cyber threat intelligence enriched 
data sets and intelligence databases both for real-time situational awareness and historical 
OSINT preservation purposes which also include to actually "connect the dots" in cybercrime 
gang and rogue cyber actor campaigns and cyber attack type of campaigns. A general ex- 
ample would consist of obtaining a single malicious software sample and using it on a public 
sandbox to further map the infrastructure of the cybercriminal behind it potentially exposing 
the big picture behind the campaign and connecting the dots behind their infrastructure which 
would lead to a multi-tude and variety of personally identifiable information getting exposed 
which could help build a proprietary cybercrime gang activity database and actually assist LE 
in tracking down the prosecuting the cybercriminals behind these campaigns. 


"There’s no such thing as new cyber threat actors. It’s just new players adopting economic 
and marketing concepts to steal money and cause havoc online." 


The primary idea here is to locate free and public online repositories of malicious software and 
to actually obtain a sample which will be later on used in a public sandbox for the purpose of 
mapping the Internet-connected infrastructure of the cybercrime gang in question including to 
actually elabore more on the ways they attempt to monetize the access to the compromised 
host including possibly ways in which they make money including to actually find out what 
exactly are they trying to compromise. Possible examples here include VirusTotal or actually 
running a malware interception honeypot such as for instance a spam trap which would allow 
you to intercept currently circulating in the wild malare campaigns that propagate using email 
and actually analyze them in terms of connecting the dots exposing their Internet-connected in- 
frastructure and establishing the foundations for a successful career into the world of malicious 
software analysis and cybercrime research. 


"Everything that can be seen is already there". 


The next logical step would be to properly assess and analyze the recently obtained sample and 
to properly establish the foundation of a "connect the dots" culture within your organization 
where the primary goal would be to have researchers and analysts look for clues on their way 
to track down and monitor a specific campaign potentially coming up with new and novel cyber 
attack attribution research. Visualization is often the key to everything in terms of visualizing 
threats and looking for additional clues and possible cyber attack attribution clues where a 
popular visualization and threat analysis tool known as Maltego should come into play which 
basically offers an advanced and sophisticated way to process OSINT and cybercrime research 
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and threat intelligence type of information and actually enrich it using public and proprietary 
sources of information for the purpose of establishing the big picture and actually connecting 
the dots for a specific cyber attack campaign. 


Among the first things that you should consider before beginning your career in the World 
of OSINT is that everything that you need to know about a specific online event a specific 
online campaign that also includes the activities of the bad guys online is already out there 
in the form of publicly accessible information which should be only processed and enriched 
to the point where the big picture for a specific event or a malicious online campaign should 
be established using both qualitative and quantitative methodologies that also includes the 
process of obtaining access to the actual technical details and information behind a specific 
online event or an actual malicious and rogue online campaign. 


Among the few key things to keep in mind when doing OSINT including actual OSINT for cyber 
attack and cyber campaign attack attribution is the fact that in 99 % of the cases all the col- 
lection information that you need in terms of a specific case is already publicly known and is 
publicly accessible instead of having to obtain access to a private or a proprietary source of 
information and the only thing that you would have to do to obtain access to it is to use the 
World’s most popular search engine in terms of collection processing and enrichment. 


The second most popular thing to keep in mind when doing OSINT is that you don’t need to 
obtain access to proprietary even public OSINT tools. 


Current State of the Cybercrime Ecosystem 


In 2021 a huge number of the threats facing the security industry including vendors and orga- 
nizations online include RATs (Remote Access Tools) malicious software part of a larger bother 
malicious and fraudulent spam and phishing emails including client-side exploits and vulner- 
abilities which have the potential to exploit an organization or a vendor's end points for the 
purpose of dropping malware on the affected host including the rise of the ransomware threat 
which is basically an old fashioned academic concept known as cryptoviral extortion. 


With more novice cybercriminals joining the underground ecosystem market segment largely 
driven by a set of newly emerged affiliate based revenue sharing fraudulent and malicious 
networks offering financial incentive for participation in a fraudulent scheme it shouldn’t be 
surprising that more people are actually joining the cybercrime ecosystem potentially causing 
widespread damage and havoc online. 


With cybercrime friendly forums continuing to proliferate it should be clearly evident that more 
people will eventually join these marketplaces potentially looking for new market segment 
propositions to take advantage of for the purpose of joining the cybercrime ecosystem and that 
more vendors will eventually continue to occupy and launch new underground forum market 
propositions for the purpose of promoting and looking for new clients for the services. 


In a World dominated by a geopolitically relevant Internet cybercrime ecosystem it shouldn’t 
be surprising that more international cybercrime gangs will eventually continue to launch new 
fraudulent and malicious spam and phishing campaigns that also includes malicious software 
Campaigns for the purpose of earning fraudulent revenue. 


With more affiliate based underground market segment based networks aiming to attract new 
uses where they would forward the risk for the actual infection process and fraudulent transac- 
tion to the actual user in exchange for offering access to sophisticated bulletproof infrastructure 
including advanced and sophisticated malware and ransomware releases it shouldn’t be sur- 
prising that more people are actually joining these affiliate networks for the purpose of earning 
fraudulent revenue in the process of causing havoc and widespread disruption online. 
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In this brief Basics of OSINT in the context of fighting cybercrime article we provided a general 
overview of the process of using OSINT for cybercrime fighting purposes and we hope that you 
enjoyed the article and will be eager to go through the second part of the article series which 
will be published at our Web site in the coming weeks. 


Sample screenshots include: 


[2] 


[3] 


ABOUTUS = 
Dancho Danchey Presents 


Danche Danchev is an internationally recognized 
cybercrime researcher security blogger OSINT analyst-and 
threat intelligence analyst that's currently running one of 
the security industry's most popular security publications 


his personal blog - https //ddanchev blogspot.com since or tive 
December, 2005 which has received approximately 5.6M di : 
page views since its original start In IVI Ua S 


ies are BASIC AND ADVANCED 


/ 
OSINT AND THREAT INTELLIENCE 
a PROGRAM BUILDING AND TRAINING 
REACHUS : 7 
+359876893890 : 


Email: dancho.danchev@hush.com 


https; //ddanchev.blogspot.com 


HTTPS://DDANCHEV, BLOGSPOT,COM 


1 
2. https: //blogger. googleusercontent .com/img/b/R29vZ2x1/AVvXsEixYeeyt IDyWh-x6BIrtSYHOTti0-FikY3_keJq_ApIkriJ 
3 
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1.2.13 Today’s Compilation of Botnet’s C&C Panels (2023-04-28 14:31) 


[1] 


| Unlock 


| decided to share with everyone a currently active set of botnet C &C panels which | 
obtained using OSINT and public sources which are currently active in the time of posting 
this with the idea to raise more awareness on their existence and potentially prompt you to 
go deeper in terms of research and tracking down the cybercriminals behind these campaigns. 


Known responding IPs: 

190[.]123[.]44[.]145 

37[.]139[.]129[.]69 

79[.]137[.]203[.]19 

179[.143[.]142[.]172 

31[.]41[.]244[.]146 

Sample C &C Panels: 
hxxp://sertvs[.]com/8vcWxwwx3/index[.]php 
hxxp://specialblue[.]in/dF30Hn4m/index[.]php 
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hxxp://79[.]137[.]203[.]19/6nd8ssa3/Login[.]php 
hxxp://179[.]43[.]142[.]172:443/admin/console/ 
hxxp://31[.]41[.]244[.]146/u83mfdS2/Login[.]php 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEgF i0yztd5vhf AvhLaj 1RF JoHdndVCWS7TGWifh5HOO6IOW 
BSDQW_KnwnBQyqknL0O jKoDcWu9W43MAFF5gcdYwdY48D6LHuxa4RHA 


1.2.14 A Compilation of Koobface Botnet Themed Malicious Executable Download 
Locations 2009 - 2011 (2023-04-28 14:31) 


[1] 


San ip | Quickies (0) | Heb | lua s 


Video posted by ... Sponge Bob... 


us como“ a ey 


Video Responses: 10 Text Comments: 70 


Would you like to comment? 


While digging into my old threat intelligence research archive | found the following which | 
decided to share with everyone. 


Happy "takes you back doesn’t it" time and OSINT and threat intelligence for historical cross- 
checking and connecting the dots time. 


Sample URLs include: 
hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=poster [.]10[.]exe 
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hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=fri endfeedreg[.]1[.]exe 
hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=aolsbm[ .]2[.]Jexe 
hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=twreg[. ]12[.]exe 
hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=tumreg [.]1[.]Jexe 
hxxp://roomservicedesign[.]com[.]Jau/[.]9mov05w/?getexe=drk[.] exe 
hxxp://roomservicedesign[.]com[.]Jau/[.]9mov05w/?getexe=ffe32[. Jexe 
hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=y ahblog[.Jexe 
hxxp://mdcoc[.]net/jxjvOz2s/setup798342[.]exe 

hxxp://wwwl[. ]blowmeupbig[.]com/[.]iunb8/?getexe=za[.]exe 
hxxp://wwwl[.]blowmeupbig[.]com/[.]iunb8/?getexe=hny32[.]exe 
hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=m24[.]i n[.]exe 
hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=dg[.] exe 
hxxp://anlaegkp[.]dk/trygxqlz/setup314555[.]Jexe 
hxxp://lyulf[.]co[.]uk/2pmflqq/setup742472[.]exe 
hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=ff2ie[.]exe 
hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=p[.]Jexe 
hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=m24[.]in[.Jex e 
hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=dg[.]exe 
hxxp://solarinstitut[. ]com/yf734/index[.]php?e=635893 
hxxp://helpingouryouthachieve[.]com/sim/index[.]php?e=590202 
hxxp://wwwl[.]darelorenzo[. Jit/[.]sys/?action=fbgen &v=104 &crc=669 
hxxp://1zabslwvn538n4i5tcjl[.]com/temp/exe/codec[.]exe 
hxxp://smx[.]nu/y580/setup[.]exe 

hxxp://mantleofmercy[.]org/07/ 

hxxp://watvindteindhoven[.]nl/614/?go 
hxxp://stagnescathedral[.Jorg/actualperformans/?72691/ 
hxxp://partenaires-particuliers[. ]fr/[. ]abodpg/?getexe=tg[. ]16[.Jexe 
hxxp://viale[.]be/[.]jxel/?getexe=p[.]exe 
hxxp://viale[.]be/[.]jxel/?getexe=ws[.]exe 
hxxp://cedelevator[.]com/[.]sys/?getexe=tg[.]16[.]exe 
hxxp://wwwl[.]person[.]doae[.]go[.]th/[.]sys/?getexe=tg[ .]16[.]exe 
hxxp://ntas[.]com/[.]sys/?getexe=tg[.]16[.Jexe 
hxxp://waypoint-center[.]org/[.]sys/?action=ppgen &a=-2001606274 &v=106 &pid=1000 
hxxp://waypoint-center[. Jorg/[.]sys/?action=fobgen &v=106 &crc=669 
hxxp://deltasatuk[.]com/[.]sys/?getexe=cmd[.]Jexe 

504 


hxxp://deltasatuk[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://deltasatuk[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=ws[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=cmd[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=cmd[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=ws|[.]lexe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=cmd[.]lexe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=hostsgb3][.]e xe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=cmd[.]Jexe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=hostsgb3[.] exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=ws|[.]lexe 
hxxp://sphusa[.]com/[.]sys/?getexe=cmd[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://tjsokolosek[.]wz[.]cz/[.]sys/?getexe=loader[.]exe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=cmd[.]Jexe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=hostsgb3[. ]exe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=hostsgb3[.] exe 
hxxp://wwwJ[. ]trattoriabilly[.]com/[.]sys/?getexe=ws[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=hostsgb3[.]exe 
hxxp://wwwI.]jwdtrees[.]com/[.]sys/?getexe=hostsgb3[.]exe 


hxxp://wwwl[.]jwdtrees[.]com/[.]sys/?getexe=loader[.]exe 


hxxp://wwwl.]lionkitchen[.]com[.]sg/[.]sys/?getexe=loader[ .]exe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=hosts2[.]Jex e 
hxxp://wwwl[. ]wttcmil[.]com/[.]sys/?getexe=hosts2[.]exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=loader[.]exe 
hxxp://cooperville[.]be/[.]sys/? getexe=go[.]exe 
hxxp://cooperville[.]be/[.]sys/? getexe=loader[.]exe 
hxxp://cooperville[.]be/[.]sys/?getexe=pp[.]14[.]lexe 
hxxp://cooperville[.]be/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://cooperville[.]be/[.]sys/?getexe=v2captcha21[.]lexe 
hxxp://cooperville[.]be/[.]sys/? getexe=v2newblogger[.]exe 
hxxp://cooperville[.]be/[.]sys/? getexe=v2webserver|[.]lexe 
hxxp://deltasatuk[.]com/[.]sys/?getexe=go[.]exe 
hxxp://deltasatuk[.]com/[.]sys/? getexe=loader[.]exe 
hxxp://deltasatuk[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://deltasatuk[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://deltasatuk[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://deltasatuk[.]com/[.]sys/? getexe=v2newblogger[.]exe 
hxxp://deltasatuk[.]com/[.]sys/? getexe=v2webserver|[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=go[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=loader[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://edensensuel[. ]fr/[.]sys/?getexe=v2webserver[.]e xe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=go[.]Jexe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=hosts2[.]exe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=loader[.]exe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=p[.]exe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://ertrafikskola[.]se/[.]sys/?getexe=v2webserver[.]exe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=go[.]exe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hosts2[.]exe 
hxxp://formacio[.]eio[.]Jes/[.]sys/?getexe=pp[.]14[.]exe 

506 


hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2bloggerjs[.Je xe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://formacio[.]eio[.]Jes/[.]sys/?getexe=v2newblogger|.]exe 
hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2webserver[.]exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=go[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=hosts2[.]exe 
hxxp://grdcb[.]Jcom/[.]sys/?getexe=p[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://grdcb[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=go[.]exe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=pp[.]14[.]e xe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2bloggerjs[.] exe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2captcha21[.]Je xe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2newblogger[. Jexe 
hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2webserver[.]Je xe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2captcha21[.]Jexe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2newblogger[.]lexe 
hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://juanfurlan[.]com[. Jar/[.]sys/?getexe=v2captcha21[.]e xe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=go[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=hosts2[.]e xe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2bloggerjs[.Jexe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2webserver[.]lexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=p[.]exe 
hxxp://mdcoc[. ]net/[.]sys/?getexe=go[.]exe 

hxxp://mdcoc[. ]net/[.]sys/?getexe=hosts2[.]exe 


hxxp://mdcoc[. ]net/[.]sys/?getexe=p[.]exe 


hxxp://mdcoc[.]net/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://mdcoc[.]net/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://mdcoc[.]net/[. ]sys/?getexe=v2captcha21[.]exe 
hxxp://mdcoc[.]net/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://mdcoc[.]net/[. ]sys/?getexe=v2newblogger[.]Jexe 
hxxp://mdcoc[.]net/[.]sys/?getexe=v2webserver[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=go[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=loader[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2captcha21[.]lexe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2webserver[.]Jexe 
hxxp://prostruction[. ]net/[.]sys/?getexe=go[.]exe 
hxxp://prostruction[. ]net/[.]sys/?getexe=hosts2[.]exe 
hxxp://prostruction[. ]net/[.]sys/?getexe=p[.]exe 
hxxp://prostruction[. ]net/[.]sys/?getexe=v2webserver[.]lexe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=go[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=hosts2[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=v2newblogger[.]lexe 
hxxp://shirleymancino[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=go[.]exe 
hxxp://sphusal[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://sphusa[.]com/[.]sys/?getexe=pp[.]14[.]Jexe 
hxxp://sphusa[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?get exe=loader[.]exe 
hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=pp[. ]14[.Jexe 
hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2blogg erjs[.]exe 
hxxp://testing[.Jonlinesigns[.]co[.]za/[.]sys/?gete xe=v2captcha21[.]exe 
hxxp://testing[.Jonlinesigns[.]co[.]za/[.]sys/?getexe=v2goog! echeck[.]exe 
508 


hxxp://testing[.Jonlinesigns[.]co[.]za/[.]sys/?getexe=v2newbl ogger[.]exe 
hxxp://testing[.]Jonlinesigns[.]co[.]za/[.]sys/?getexe=v2webse rver[.]exe 
hxxp://wwwl[.]australianslongevity[. ]net/[.]sys/?getexe=loader[ .Jexe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.Jorg/[.]sys/?gete xe=go[.Jexe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]Jsys/?gete xe=loader[.Jexe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]Jsys/?gete xe=pp[.]14[.]exe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.Jorg/[.]sys/?gete xe=v2bloggerjs[.Jexe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?gete xe=v2captcha21[.]exe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.]Jorg/[.]sys/?gete xe=v2newblogger[.]exe 
hxxp://www[.]corteostoricoterrasanctibenedicti[.]Jorg/[.]sys/?gete xe=v2webserver[.]exe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=go[.]ex e 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=hosts2[ .Jexe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=loa der[.]exe 
hxxp://wwwl[.]dinovincenzopatroni[.]com/[.]sys/?getexe=pp[.]14 [.]exe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2blogger js[.]Jexe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2ca ptcha21[.]exe 
hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2googleche ck[.]exe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2newblogge r[.]exe 
hxxp://wwwI[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2webserv er[.]exe 
hxxp://wwwl.]fininve[. Jit/[. ]sys/?getexe=go[.]exe 
hxxp://wwwl.]fininve[. Jit/[. ]sys/?getexe=loader[.] exe 

hxxp://wwwl.]fininve[. Jit/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://wwwl.]fininve[. Jit/[. ]sys/?getexe=v2bloggerjs[.]exe 

hxxp://wwwl.]fininve[. Jit/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://www[.]fininve[. Jit/[. lsys/?getexe=v2newblogger[.]Jexe 
hxxp://wwwl.]fininve[. Jit/[. ]lsys/?getexe=v2webserver[.] exe 
hxxp://wwwl.]firststategymnastics[.]com/[.]sys/?getexe=go[.]e xe 
hxxp://wwwl.]firststategymnastics[.]com/[.]sys/?getexe=lo ader[.]exe 
hxxp://wwwl.]firststategymnastics[.]com/[.]sys/?getexe=pp[.]1 4[.Jexe 
hxxp://wwwI[.]firststategymnastics[.]com/[.]sys/?getexe=v2blogge rjs[.]exe 
hxxp://wwwI.]firststategymnastics[.]com/[.]sys/?getexe= v2captcha21[.]exe 
hxxp://wwwl.]firststategymnastics[.]com/[.]sys/?getexe=v2googlech eck[.]exe 
hxxp://wwwl.]firststategymnastics[.]com/[.]sys/?getexe=v2newblogg er[.]exe 
hxxp://wwwI.]firststategymnastics[.]com/[.]sys/?getexe=v2webser ver[.Jexe 


hxxp://wwwl[.]gecahe[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 


509 


hxxp://wwwl[.]gecahe[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://wwwl. ]lavalledellupo[. Jit/[.]sys/?getexe=go[.]exe 

hxxp://wwwl. ]lavalledellupo[. Jit/[. ]sys/?getexe=pp[.]14[. Jexe 
hxxp://wwwl. ]lavalledellupo[. Jit/[.]sys/?getexe=v2bloggerjs[.] exe 
hxxp://wwwl. ]lavalledellupo[. Jit/[.]sys/?getexe=v2captcha21[.] exe 
hxxp://wwwl. ]lavalledellupo[. Jit/[.]sys/?getexe=v2newblog ger[.Jexe 
hxxp://wwwl[.]lavalledellupo[. Jit/[.]sys/?getexe=v2webserver[.] exe 
hxxp://wwwl[.]person[.]doae[.]go[.]th/[.]sys/?gete xe=pp[.]14[.Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://wwwl[.]proelec-dpt[. ]fr/[.]sys/?getexe=go[.]exe 

hxxp://wwwl. ]proelec-dptl. ]fr/[.]sys/?getexe=loader[.]exe 
hxxp://wwwl[.]proelec-dpt[. ]fr/[.]sys/?getexe=pp[.]14[.]ex e 
hxxp://wwwl[.]proelec-dpt[. Ifr/[.]sys/?getexe=v2captcha21[.]ex e 
hxxp://wwwl[.]proelec-dpt[. ]fr/[.]sys/?getexe=v2webserver[.]ex e 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=loader|[.]ex e 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=pp[.]14[ .Jexe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=v2bloggerjs[ .Jexe 
hxxp://www[. ]shogunlevallois[.]com/[.]sys/?getexe=v2captcha21[. Jexe 
hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2googlecheck [.]exe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]lsys/?getexe=v2newblogger[ .]Jexe 
hxxp://wwwl[.]shogunlevallois[.]com/[.]sys/?getexe=v2webserver[. Jexe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://wwwlI.]skylergreene[.]com/[.]sys/?getexe=pp[.]14[.] exe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=v2blogger js[.Jexe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=v2captcha21[.] exe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=v2googlecheck[ .Jexe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=v2newblogger[.] exe 
hxxp://wwwl[.]skylergreene[.]com/[.]sys/?getexe=v2webserver[. Jexe 
hxxp://wwwl[. ]trattoriabilly[.]com/[.]sys/?getexe=go[.]exe 

hxxp://wwwl[. ]trattoriabilly[.]com/[.]sys/?getexe=hosts2[.]e xe 
hxxp://wwwl. |trattoriabilly[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://wwwl. ]trattoriabilly[.]com/[.]sys/?getexe=pp[.]14[ .Jexe 
hxxp://wwwl. ]trattoriabilly[.]com/[.]sys/?getexe=v2bloggerjs[. Jexe 
hxxp://wwwl. |trattoriabilly[.]com/[.]sys/?getexe=v2captcha21[ .Jexe 
510 


hxxp://wwwl. ]trattoriabilly[.]com/[.]sys/?getexe=v2google check[.]exe 
hxxp://wwwJ. ]trattoriabilly[.]com/[.]sys/?getexe=v2newblogger[. Jexe 
hxxp://wwwl.]trattoriabilly[.]com/[.]sys/?getexe=v2webserver| .Jexe 
hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=go[.]exe 
hxxp://www[.]waypoint-center[.]lorg/[.]sys/?getexe=hosts2[.]ex e 
hxxp://wwwl.]waypoint-center[.]lorg/[.]sys/?getexe=p[.]Jexe 
hxxp://wwwl.]waypoint-center[.]org/[.]sys/?getexe=pp[.]14[. ]exe 
hxxp://www[.]waypoint-center[.]Jorg/[.]sys/?getexe=v2captcha21[ .Jexe 
hxxp://wwwl[.]waypoint-center[.]lorg/[.]sys/?getexe=v2webserver| .Jexe 
hxxp://www[.]wttcmil[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwI[.]wttcmil[.]com/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://wwwI[.]wttcmil[.]com/[.]sys/?getexe=v2bloggerjs[.Je xe 
hxxp://wwwI[.]wttcmil[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://wwwI[.]wttcmil[.]com/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://wwwI[.]wttcmi[.]com/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://wwwI[.]wttcmil[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=go[.]ex e 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=hosts2[.]exe 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=p[.]exe 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=v2newblogger[.]e xe 
hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=v2webserver[.]exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=fb[.]101[. Jexe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=pp[.]14[.] exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2bloggerjs[.] exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2captcha21[.] exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2googlecheck[. Jexe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2newblogger[.] exe 
hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2webserver[.] exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=fb[.]101[.]exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=go[.]exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://goldenliontech[.]com/[.]sys/?getexe=v2webserver[.]lexe 


hxxp://lotuscovecampground[.]com/[.]sys/?getexe=fb[.]101[.]ex e 


hxxp://lotuscovecampground[.]com/[.]sys/?getexe=go[.]exe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2bloggerjs[.Je xe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2googlecheck[.] exe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2newblogger[.]ex e 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2webserver[.]e xe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=v2captcha21[.]exe 

hxxp://wwwl[. Jaustralianslongevity[.]net/[.]sys/?getexe=v2newblogg er[.]exe 
hxxp://wwwl[.]Jaustralianslongevity[.]net/[.]sys/?getexe=v2webserve r[.]exe 
hxxp://wwwl[.]Jaustralianslongevity[.]net/[.]sys/?getexe=pp[.] 14[.]exe 
hxxp://wwwl[. Jaustralianslongevity[.]net/[.]sys/?getexe=v2 bloggerjs[.]exe 
hxxp://wwwl[. Jaustralianslongevity[.]net/[.]sys/?getexe=v2captcha2 1[.]exe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=fb[.]101[.]exe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://wwwl[.Intas[.]com/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=v2prx[.]Jexe 
hxxp://wwwl[.]ntas[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=fb[.]101[. Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=pp[.]14[.] exe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=v2bloggerjs[. Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=v2captcha21[ .Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=v2googlecheck[. Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=v2newblogger[ .Jexe 
hxxp://wwwl[.]powertreecorp[.]com/[.]sys/?getexe=v2webserver[.] exe 
hxxp://comunicat-de-presa[. ]ro/[.]sys/?getexe=hosts2[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=v2bloggerjs[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=v2newblogger[.] exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=v2captcha21[.]exe 
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hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2captcha21[. Jexe 
hxxp://reishus[.]de/[.]sys/?getexe=loader[.]exe 
hxxp://reishus[.]de/[.]sys/?getexe=v2captcha21[.]exe 
hxxp://wwwl[.]bastakigroup[.]com/[.]sys/?getexe=v2captcha21[.] exe 
hxxp://www[.]comunicat-de-presal[.]ro/[.]sys/?getexe=v2captcha21[. Jexe 
hxxp://wwwl.]its-email[.]co[.]uk/[.]sys/?getexe=v2blogger js[.]exe 
hxxp://wwwJ. Jits-email[.]co[.]uk/[.]sys/?getexe=v2captcha 21[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=fb[.]101[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=go[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=hosts2[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=v2googlecheck[.]exe 
hxxp://goldmaniac[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://www[.]bastakigroup[.]com/[.]sys/?getexe=pp[.]14[. Jexe 
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hxxp://www[.]comunicat-de-presa[. ]ro/[.]sys/?getexe=loader[.] exe 
hxxp://wwwl[.]comunicat-de-presal[.]ro/[.]sys/?getexe=pp[.]14[ .Jexe 
hxxp://wwwl[.]comunicat-de-presal[.]ro/[.]sys/?getexe=v2bloggerjs[ .Jexe 
hxxp://www[.]comunicat-de-presal[. ]ro/[.]sys/?getexe=v2captchal[.] exe 
hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2googlecheck[ .Jexe 
hxxp://www[.]comunicat-de-presal[. ]ro/[.]sys/?getexe=v2newblogger| .Jexe 
hxxp://www[.]comunicat-de-presa[. ]ro/[.]sys/?getexe=v2prx[.]exe 
hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2webserver|[ .Jexe 
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hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=fb[.]8 4[.]exe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=fbcheck[. Jexe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=go[.]Je xe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=hosts2[.] exe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=p p[.]14[.]exe 
hxxp://wwwl[.]tabdesign[.]Jcom[.]sg/[.]sys/?getexe=v2captchal[ .Jexe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=v2prx[. Jexe 
hxxp://wwwl[. ]tabdesign[.]com[.]sg/[.]sys/?getexe=v2webserver [.]exe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=fb[.]84[.Jexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=fbcheck[.]Jexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=go[.]exe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=hosts2[.]exe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=pp[.]14[.Jexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2captcha[.]Jexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2prx[.]Jexe 
hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://easygiftgiving[.]com/[.]sys/?getexe=go[.]exe 
hxxp://easygiftgiving[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://easygiftgiving[.]com/[.]sys/?getexe=v2captchal[.]lexe 
hxxp://easygiftgiving[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://easygiftgiving[.]com/[.]sys/? getexe=v2webserver[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=fb[.]84[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=flbocheck[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=go[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=hosts2[.]lexe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=v2captchal[.]exe 
hxxp://inartdesigns[.]com/[.]sys/?getexe=v2prx[.]exe 
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hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=pp[.]14[.]exe 
hxxp://wwwl[.]timsmurf[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=v2webserver[.]exe 
hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=fb[ .]81[.]Jexe 
hxxp://wwwl[.]tabdesign[.]com[.]sg/[.]sys/?getexe=gr[.]05 [.]exe 
hxxp://wwwI.]timsmurf[.]com/[.]sys/?getexe=fb[.]81[ .Jexe 
hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=ff2ie[.]exe 
hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=loader[.Jexe 
hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=twI[.]08 [.]exe 
hxxp://wwwl[.]timsmurf[.]com/[.]sys/?getexe=v2captchal[.]exe 
hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=v2googlecheck[.] exe 
hxxp://wwwI[.]timsmurf[.]com/[.]sys/?getexe=v2newblogger[.]exe 
hxxp://wwwl[.]moviemusicuk[.]us/index[.]htm/?go 
hxxp://wwwl.]wvgoldwings[.]com/video/ 
hxxp://wwwl[.]wvgoldwings[.]com/video/?go 
hxxp://boatnews[.]Jeu/[.]sys/?getexe=fb[.]76[.]exe 
hxxp://boatnews[.]eu/[.]sys/?getexe=go[.]Jexe 

hxxp://boatnews[. ]Jeu/[.]sys/?getexe=pp[.]13[.Jexe 
hxxp://boatnews[.]eu/[.]sys/?getexe=v2prx[.]exe 
hxxp://boatnews|[. ]Jeu/[.]sys/?getexe=v2webserver[.]exe 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=fb[.]76[.]ex e 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=fblanding[.] exe 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=go[.]exe 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=pp[.]13[.] exe 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=v2prx[.]exe 
hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=v2webserver| .Jexe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fb[.]76[.]exe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fblanding[.]e xe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=pp[.]13[.Jexe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2webserver[. Jexe 
hxxp://reishus[.]de/[.]sys/?getexe=ms[.]26[.]exe 
hxxp://whatsupgreenville[.]com/[.]sys/?getexe=fb[.]76[.]exe 
hxxp://whatsupgreenville[.]com/[.]sys/?getexe=fblanding[.]lexe 
hxxp://whatsupgreenville[.]com/[.]sys/?getexe=go[.]exe 
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hxxp://whatsupgreenville[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://whatsupgreenville[.]com/[.]sys/?getexe=v2webserver[.]lexe 
hxxp://wwwl[.]starbrands-ltd[.]com/[.]sys/?getexe=loader[.]exe 
hxxp://suntico-dev[.]com/950/index[.]php?go 
hxxp://musikskolan[.Jorsa[.]se/434/?go 
hxxp://rayfordliesbet[. ]blogspot[.]com/ 
hxxp://sessionsmatarmatar[.]blogspot[.]com/ 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=go[.]exe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=mded[.]exe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=tw[.]07[.Je xe 
hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=go[.]exe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=go[.]exe 
hxxp://teplomer1[.]czechian[.]net/[.]sys/?getexe=go[.]exe 
hxxp://wwwl[.]foo6[.]com/[.]sys/?getexe=fb[.]75[.]exe 
hxxp://wwwl[.]foo6[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwl.]foo6[.]com/[.]sys/?getexe=mded[.]lexe 
hxxp://wwwl[.]foo6[.]com/[.]sys/?getexe=pp[.]12[.]exe 
hxxp://wwwl[.]foo6[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://wwwl.]fototeka[.]rs/[.]sys/?getexe=fb[.]75[.]exe 
hxxp://wwwl.]fototeka[.]rs/[.]sys/?getexe=go[.]exe 
hxxp://wwwl.]fototeka[.]rs/[.]sys/?getexe=mded[.]exe 
hxxp://wwwl. ]fototeka[.]rs/[.]sys/?getexe=pp[.]12[.Jexe 
hxxp://wwwl. ]fototeka[.]rs/[.]sys/?getexe=v2prx[.]exe 
hxxp://wwwl[.]starbrands-ltd[.]com/[.]sys/?getexe=go[.]exe 
hxxp://wwwl[.]starbrands-ltd[.]com/[.]sys/?getexe=tw[.]07[. Jexe 
hxxp://russkiytoy[.]at/[.]sys/?getexe=tw[.]07[.]exe 
hxxp://wwwl[.]foo6[.]com/[.]sys/?getexe=ff2ie[.]exe 
hxxp://arpkriswanto[.]blogspot[.]com/ 
hxxp://ayoubayoubpatouhas|[.]blogspot[.]com/ 
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hxxp://rosalieishananto[.]blogspot[.]com/ 
hxxp://russkiytoy[. Jat/[. sys/?getexe=fb[.]75[.Jexe 
hxxp://russkiytoy[. Jat/[. ]sys/?getexe=go[.]exe 
hxxp://russkiytoy[. Jat/[. ]sys/?getexe=pp[.]12[.]exe 
hxxp://russkiytoy[. Jat/[. ]sys/?getexe=v2prx[.]exe 
hxxp://totallyask[.]to[.]ohost[.]de/207/?go 
hxxp://aidanaidantattersfield[.]blogspot[.]com/ 
hxxp://nine[.]jo/834/?go 

hxxp://deploytech[.]co[.]nz/368/?go 

hxxp://insalacotecwyn[. ]blogspot[.]com/ 
hxxp://jurgisbooty[.]blogspot[.]com/ 
hxxp://parrisvistisen[.]blogspot[.]com/ 
hxxp://rotermundraimon|[.]blogspot[.]com/ 
hxxp://tendaiblunk[.]blogspot[.]com/ 
hxxp://agr255[.]cne-escutismo[.]pt/[.]sys/?getexe=fb[.]75[.] exe 
hxxp://agr255[.]cne-escutismo[. ]pt/[.]sys/?getexe=get[.]Jexe 
hxxp://agr255[.]cne-escutismo[. ]pt/[.]sys/?getexe=pp[.]12[. Jexe 
hxxp://agr255[.]cne-escutismo[. ]pt/[.]sys/?getexe=v2prx[.]ex e 
hxxp://indigozeus1[.]net/zs12/bot[.]Jexe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=fb[.]75[.Je xe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=get[.]Jexe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=pp[.]12[.]e xe 
hxxp://jazz-brewery[.]com/[.]sys/?getexe=v2prx[.]exe 
hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=fb[.]75[.] exe 
hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=get[.]exe 
hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=pp[.]12[.] exe 
hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=v2prx[.]exe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fb[.]75[.]exe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=get[.]exe 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=pp[.]12[.Jex e 
hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2prx[.]exe 
hxxp://reishus[.]de/[.]sys/?getexe=fb[.]75[.]exe 
hxxp://reishus[.]de/[.]sys/?getexe=get[.]exe 
hxxp://reishus[.]de/[.]sys/?getexe=pp[.]12[.]exe 


hxxp://www[.]delicesevdam[. ]net/botistan[.]exe 


hxxp://devline[.]se/6/ 
hxxp://kiano-180809[.]com/the/?pid=30759 
hxxp://unix-service[.]com/js1[.]php 
hxxp://tohva[.]org/bestactiOn/ 

hxxp://hellnax[.]com/e/install _126[.]exe 
hxxp://magnaniwines[.]com/freeevlds/gteftf9hns2[. ]js 
hxxp://restaurant-soleildafrique[. ]fr/fuunnyvide0/o4m833a8[. js 
hxxp://jagtridningjylland[.]dk/beestdwd/87m[.]js 
hxxp://rtprestaurantguide[.]com/amalzingclips/968e8[. ]js 
hxxp://S198814458[.]Jonlinehome[.]us/yOurperfOrmans/ui9o[. ]js 
hxxp://godupholdshim[. ]netfirms[.]com/cO0ldwd/vzde[.]js 
hxxp://lionandlamb[.]biz/privalefilm/a8es[.]js 
hxxp://pangea-consulting[.]com/yOurperfOrmans/pd38ss9n-[. ]js 
hxxp://kristameier[.]com/fuunnyshOw/h80¢-[. ]js 
hxxp://proteatr[.]edu[.]Jmhost[.]ru/privaleclip/82yiiy3[.]js 
hxxp://videoleverage[.]com/beesttw/coN[. ]js 
hxxp://lpexpressions[.]com/cOOlperfOrmans/pgy[.]js 
hxxp://ram-220709[.]com/go/?pid=30937 &type=videxp 
hxxp://r-d-cgpay-090709[.]com/go/index[.]php 
hxxp://upload[.]octopus-multimedia[.]be/1/pdrv[.]exe 
hxxp://upload[.]octopus-multimedia[.]be/1/pp[.]10[.]exe 
hxxp://upload[.]octopus-multimedia[.]be/1/nfr[.]exe 
hxxp://cgpay-re-230609[.]com/the/?pid=8176 &type=videxp 
hxxp://liesbethmilan[.]be/1/be[.]15[.]lexe 

hxxp://liesbethmilan[. ]be/1/captcha6[.Jexe 
hxxp://liesbethmilan[. ]be/1/hi[.]12[.]Jexe 

hxxp://liesbethmilan[. ]be/1/ms[.]19[.]Jexe 
hxxp://liesbethmilan[.]be/1/pdrv[.Jexe 
hxxp://liesbethmilan[.]be/1/pp[.]10[.Jexe 
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hxxp://taahe[. ]bij[.]pl/cowgirls[.]htm! 
hxxp://yourfindguide[.]com/search[.]php?said=net15 &q=jesus+christ &rfrl= 
hxxp://rd040609-cgpay[.]net 

hxxp://nicevideo18[. ]net/software/ea2faf7008/11400/1/Setup[.]exe 
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hxxp://niceshoot89[.]com/software/04f456eca8/30000/1/Setup[.]lexe 
hxxp://updatedb87[.]cn/out/load[.]php 
hxxp://bewfsnfwka[.]net/ccsuper3[.]php 
hxxp://r-cgpay-15062009[.]com/go/index[.]php 
hxxp://carlossextube[.]com 
hxxp://r-cg100609[.]com/go/?pid=10160 &type=videxp 
hxxp://r-cg100609[.]com/the/?pid=8198 
hxxp://utopia-products[.]com/setup[.]exe 
hxxp://wwwl.losftp[.]yoyo[.]pl/1/nfr[.Jexe 
hxxp://wwwl.losftp[.]yoyo[.]pl/1/pp[.]10[.]exe 
hxxp://wwwl[.]utopia-footwear[.]com[.]au/setup[.]exe 
hxxp://nicevideo44[.]com/download/1/1000/5 
hxxp://cgpay0406[.]com/the/?pid=8198 
hxxp://evidek[.]ro/1/tg[.]12[.]exe 
hxxp://google-reseach[.]com/gfeed/link/18 escort female old _year/1_default[.]html 
hxxp://mailgov[.]net/gfeed/click[.]php?q= &p=1 
hxxp://mailgov[.]net/tds/go[.]php?sid=1 &tds-key= 
hxxp://evidek[.]ro/1/pp[.]10[.]Jexe 
hxxp://redir3105[.]com/go/index[.]php 
hxxp://videogtx4you1[.]com/download/1/1234/0 
hxxp://videofx4you1[.]com/software/019d135faa/10180/1/Setup[.]exe 
hxxp://search-adverts[. ]net/forum/load[.]php?id=4 
hxxp://indigolife[.]com[.]au/fantasticdemonstration/Irxgodudz[.] js 
hxxp://videofx4you2[.]com/download/1/1000/5 
hxxp://videofx4you2[.]com/software/a6a6ed398e/10005/1/Setup[ .Jexe 
hxxp://videofx4you2[.]com/view/1/1000/5 
hxxp://redir1805[.]com/go/fb _s[.]php 
hxxp://wwwl.]limnos[.]si/nome-video/ 
hxxp://dI[.]guarddog2009[.]com/cw[.]Jexe 
hxxp://redir1805[.]com/the/?pid=10350 &type=exe 
hxxp://megavipsite[.]cn/avl/162[.lexe 
hxxp://megavipsite[.]cn/avl/178[.lexe 
hxxp://stjude-rawang[.]com/1/nfr[.]exe 
hxxp://stjude-rawang[.]com/1/pp[.]08[.]exe 
hxxp://mxviewworldmy2[.]com/download/1/1113/1/FlashPlayer[.]v9 
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hxxp://tubeee[.]com/video[.]php?!=5:52 &id=0 &n=teen &a=whiteboy66 
&path=[.]/tmb/teen/04[.]jpg &rat=[.]/img/rating3[.]jog &v=122575 


hxxp://jii[.]be/s116/in[.Jcgi?16 
hxxp://livestockfeed[.]cn/mov/r/index[.]html 
hxxp://redir2404[.]com/the/?pid=8047 &type=videxp 
hxxp://mxviewworldmy1[.]com/view/1/1193/0 
hxxp://puttsoftwareupdate[.]com/images/2[.]exe 
hxxp://puttsoftwareupdate[.]com/images/p[.]exe 
hxxp://tds[.]smallsexvids[.]info/go[.]php?sid=1 
hxxp://hxviewworldmy1[.]com/software/3f507c14a5/12440/1/Setup[.]exe 
hxxp://popka-klass[.]net 
hxxp://rxtraffclicks[.]com/download/1/1000/5 
hxxp://directseek[.]org/25/load[.]php 

hxxp://redir1504[.]com/go/ 

hxxp://redir2304[.]com/go/ 

hxxp://redir2404[.]com/go/ 

hxxp://y18032009[.]com/go/ 

hxxp://y18032009[.]com/the/ 

hxxp://y18032009[.]com/the/? pid=1 
hxxp://y18032009[.]com/the/? pid=2 
hxxp://hxviewworldmy2[.]com/software/e3d6b7561f/10005/1/Setup[.]Jexe 
hxxp://expfanclub[.]com/lom/index[.]php 
hxxp://hqviewworldmy1[.]com/software/c2fb59fa16/12221/1/2[.]exe 
hxxp://traffbox[.]Jcom/in[.]cgi?3 
hxxp://rtraffclicks[.]com/software/38e4f74690/10005/1/Setup[.]exe 
hxxp://viewworldmy2[.]com/software/38e4f74690/10005/1/Setup[.]exe 
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Guess who’s been busy setting them straight in cyberspace? Well that would be unfortunately 
throughout 2008-2013 when | was most active online making the headlines at unknown places 
online making my day and inspiring me to track down the Koobface botnet on a daily basis. 


Keywords: Dark Web, Dark Web Onion, Hacking, Hacker, Hackers, Dancho Danchev, Intelli- 
gence, Intelligence Studies, Intelligence Community, NSA, GCHQ, Cyber Intelligence, Malicious 
Software, Malware, Cyber Surveillance, Eavesdropping, Wiretapping, Top Secret, Classified, Top 
Secret Program, Classified Program, Cybercrime, Data Mining, Big Data, Cybercrime Research, 
Threat Intelligence, Security Industry, Information Security, Information Security Industry, Com- 
puter Security, Computer Hacking, Network Security, Network Hacking, OSINT, Russia, Iran, 
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Russian Hackers, Iranian Hackers, Russian Cybercriminal, Cybercrime Forum, Cybercrime Fo- 
rum Community, Astalavista, Astalavista.box.sk, Box.sk, Box.sk Network, Cracks, Serials, Key- 
gens, Key Generators, Hacker Search Engine, Cracks Search Engine, Serials Search Engine, 
Threat Intelligence, Cybercrime Research, Malware, Malicious Software, Botnet, Botnets, Re- 
verse Engineering 
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It used to be quite a privilege when | originally attempted to publish an article which | 
proposed to one of my homeland’s primary technology magazine HiComm and when | got 
actually invited to publish a series of articles on a monthly basis. Among the first things 
which | did back then was to translate my extremely popular document “The Complete 
Windows Trojans Paper” to Bulgarian which was quite a success and the article got published 
and accepted which was originally published in the Christmas edition of the magazine. The 
original story behind my infamous “The Complete Windows Trojans Paper” was a major shift 
between my understanding and experience within the hacking Scene and the modern 
security industry where | really wanted and did my best to have a career which leads me to 
today’s leading expert in the field of cybercrime research and threat intelligence including 
security blogging and OSINT research and analysis on the bad guys including various 
international and well known cyber threat actors. 


| originally wrote and released my “The Complete Windows Trojans Paper” on my own as part 
of a major marketing effort to promote my knowledge and expertise in the scene where the 
ultimate goal was to produce a high-quality and never released publication on the topic and 
basically make it easier for everyone to understand the ongoing trend that have to do with 
trojan horses back then where | later on originally published my publication on what used to 
be among my first independent contractor position at my first employer at the time which 
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was Netherlands-based Frame4 Security Systems where | also did a marketing editorial on 
the company’s web site and has been supporting and working with the company ever since. 
The interesting part back then was that I also got a personal recommendation from the 
company owner for my university application which at the time was a Netherlands-based 
university where | had the ambition to relocate with my girlfriend and partner in life at the 
time which we eventually did with the idea to visit and actually go to study in that country. 


While | was in Bulgaria during my teenage hacker years | was busy freelancing as an 
information security consultant while working with international security portals where | was 
busy offering advice and practical information security advice and practical solution 
recommendations including my work with ClO.bg where | once contributed with an article on 
Cyberterrorism and Cyber Jihad including a series of publications for HiComm.bg where | was 
running a popular information security rubric and participated with several articles in several 
of the magazine’s issues. 


At a later stage | somehow decided to go corporate an in a way find a way to enter the 
commercial information security industry with my knowledge potentially beginning to 
contribute with knowledge and information using my personal contacts at various information 
security portals on my way to land a possible job preferably as a writer security blogger ora 
journalist which | apparently succeeded in doing as I’ve been actively contributing with my 
own research and knowledge on a variety of h/c/p/a (Hacking/Cracking/Phreaking/Anarchy) 
portals at the time. At some point in time Dancho decide to approach the primary operator of 
one of his favorite security Web sites at the time — https://net-security.org for the purpose of 
contributing with an article for their newly launched forbidden.net-security.org project. 


My idea was to contribute with a security article for their recently launched Newsletter and 
the article in question was a good old-fashioned “How to use trojan horses” manual. The 
article eventually got accepted and Dancho felt proud of himself for making a contribution to 
the project and having his article published so that eventually more people will read it and 
send him an email with questions about trojan horses and the actual article. The primary 
Webmaster of net-security.org at the time was Berislav Kucan and the project still remains 
one of my favorite and most popular visited security Web site on a daily basis. At a later 
stage | decided to establish a working relationship with Frame4 Security Systems which is a 
Dutch-based company for the purpose of writing an improved version of the original “How to 
use trojan horses” paper which later on became the “The Complete Windows Trojans Paper” 
which quickly became one of the Scene’s most popular and highly read paper on modern 
trojan horses and how to use them and how to protect against them. 


With the summer coming to an end | got an offer to begin to work at the local office of his ISP 
(Internet Service Provider) which at the time was Digital Systems for the position of office 
assistant where he was responsible for introducing new clients to the ISP’s service offering 
and for processing invoices. Among the key benefits for working at the local ISP office was 
the actual bandwidth that he got access to allowing him to access the Internet without any 
sort of limitations which he used to visit some of his favorite Top50 and Top100 security and 
hacking Web sites where he eventually downloaded some of the most recently released 
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hacking and security tools including trojan horses which he copied on a floppy disk and 
eventually brought back home during the lunch break for the purpose of exchanging the 
information with his second employer at the time which was an anti-trojans vendor using a 
publicly accessible FTP server for the purpose of helping his employer improve the detection 
rate for these type of programs and trojan horses. | would then receive a payment for having 
collected and actually shared these programs and trojan horses which he would use to pay 
the bills at the time and actually pay for using his ISP’s service. 


At some point in time he eventually got approached by a guy known as HeLLfiReZ who was 
interested in working with him and actually sharing his collection of trojan horses which he 
would then also share with his employer which at the time was LockDownCorp and earn 
revenue in the process. It would later come to his attention that the guy that approached him 
was actually one of the key members of the infamous Sub7 trojan horse group which at a 
particual point in time was responsible for launching a DDoS (Distributed Denial of Service) 
attack against the researcher Steve Gibson who extensively profiled the campaign and 
actually had a conversation with HeLLfiReZ and his team members for the purpose of finding 
out how launched the attack and how it took place. He would eventually run a personal 
hacking and security Web site archive using hosting courtesy of his employer LockDownCorp 
and run a popular Hacking and Security Web site which he would then feature on 
Progenic.com’s Top100 Hacking and Security Web sites including to actually offer paid 
security consultations in terms of finding out ways to help people protect their home PCs from 
trojan horses and teaching them how to use a firewall and how they can secure their home 
PCs. 


At a later stage in his early Information Security career he would visit and join 
https://itsecurity.com’s Security Clinic where | would have his personal biography featured 
and actually respond to common security questions which users of the Web site will submit 
and have his response featured on the front page potentially driving traffic to his employer at 
the time which was Frame4 Security Systems and actually improving his knowledge and 
understanding of Information Security in general. Dancho was also known for having 
participated in the Blackcode Ravers hacking group which was running the popular 
https://blackcode.com Web site at the time and actually participated with two issues of a 
popular Security Newsletter at the time which were featured on the home page of the portal. 
During the glorious years of IRC (Internet Relay Chat) where Dancho was busy hanging on 
several IRC networks including DALNet and his local country’s IRC network he managed to 
obtain the /etc/shadow password file for his entire ISP (Internet Service Provider) which at the 
time was Digital Systems and shared a copy of it with his best friend at the time George 
Kadiyski for the purpose of using several popular and high-profile Wordlists including John the 
Ripper password cracker potentially obtaining access and brute-forcing the entire password 
list for hundreds of active dial-up Internet based accounts at the time. 


Over a period of several days the results at the time were outstanding in the context of 
actually succeeding in the brute-forcing process potentially allowing Dancho and his friend to 
easily access free Internet based dial-up accounts which at the time cost money allowing 
them to use the Internet for free. At a later stage Dancho also managed to obtain access to 
his local town’s competing ISP (Internet Service Provider) which was known as BIANet 
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/etc/shadow which was send to him by a friend and he also once again shared it with his 
friend who would once again begin brute-forcing the password file using a variety of 
Worldlists and the infamous John the Ripper passwor cracking tool at the time potentially 
allowing Dancho and his friend easy access to unlimited Internet based dial-up connectivity. 


It would be fairly easy to assume how things got complicated with Dancho quickly obtaining 
access to Internet Relay Chat’s primary mIRC application including a variety of IRC-based 
“War Scripts” including a dozen of mail-bombers and various other ICQ-based type of Nukers 
and Flooders on his way to demonstrate a proper technical know-how to his friends and peers 
in the shady world of hacking. Among the first channels he tried to access were #hacker 
#hackers #hacking and the infamous #hackphreak on EFNet including to actually open 
several personal channels on the local IRC networks including #drugs #KGB and 
#linuxsecurity. At a later stage he actually managed to ask a friend for a possible operator 
status on the local town’s IRC channel where he was basically running a 24/7 online 
protection bot known as xploit including the active use of a Socks5 server which at the time 
was offered by his employer LockDownCorp where he was busy acting as Technical Collector 
of trojan horses/worms/viruses and VBS scripts for the purpose of improving the anti-trojan 
software’s signatures-based detection rates. 


Among the first thing that Dancho decided to do in his spare time is to actively research the 
local Webmaster of his hometown’s official Web site for the purpose of attempting to launch a 
social engineering attack against his local town’s official Web site which basically succeed 
and resulted in a “greeting” message being posted on the official Web site with no actual 
data destruction and data removal taking place in what would appear to be a professional 
approach when compromising a legitimate Web site for the purpose of greeting his personal 
friends and spread a message on behalf of “Trojan Hacking Group” which at the time basically 
consisted of one of his closest friends and another fellow hacker enthusiast. Among his 
responsibilities the time included the active collection of trojan horses/worms/viruses and 
VBS Scripts with the idea to share them with his employer which at the time was 
LockDownCorp one of the world’s leading anti-trojan vendors for the purpose of improving 
the detection rate for these publicly accessible trojan horses in what would later on mature 
into a successful Technical Collection operation which basically paid his bills and actually 
offered him a decent financial incentive to continue getting involved in security as a hacker 
enthusiast and actually improved his employer’s overall detection rate for some of the most 
prolific trojan horses at the time. 


The actual contractual agreement had to do with Dancho using a private FTP server where he 
would spend hours uploading collected trojan horses using his home-based dial-up connection 
and eventually earning a revenue in the process using Western Union where he was happy to 
have established direct working relationship with one of the world’s leading anti-trojans 
vendors which at the time was located at — http://proxy2.stealthedip.com/maniac/incoming/ 
Whenever Dancho would attempt to reach out to his friends he would attempt to find out 
whether they are online using a popular trojan horse including to actually check his email 
account for their recently changed passwords and other related information including their 
current IP so that he can properly connect to their home PC for educational purposes. 
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While Dancho was busy studying in the Netherlands he was busy persistently checking one 
of the World’s most popular and high-trafficked Web sites for hackers and security experts - 
Astalavista.com - and sticking to the common wisdom circa the 90‘s where everyone was busy 
making contributions and launching new groups - he decided to approach the company behind 
the portal with a possible business proposal that basically consisted of having him monitor and 
actually maintain the portal in terms of content including the actual production of a high-profile 
Security Newsletter where we would produce security and hacking articles including a featured 
Security Interview with key members from the Scene and the Security Industry. 
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What used to be a daily routine to work for ZDNet’s Zero Day blog for four productive years 
on a daily basis as a security blogger in between publishing personal research on my blog and 
later on receiving a direct offer to work with Webroot for the position of a security blogger 
was a dream come true where on both places | had the privilege to work and contribute with 
knowledge and research with some extremely knowledgeable and popular folks including my 
corporate citizenship passport which at the time was the crown jewel of my experience which 
was to visit InfoSec Europe 2012 in Earls Court in London with my company Webroot where 
knowing everyone and working with everyone from day one was quite a success and I’m ex- 
tremely grateful for contributing to the growth of the company with my own knowledge and 
expertise and for basically that | have up to present day which was the highlight of my research 
at the time namely to join the company and enter the corporate world of information security 
and security blogging which | know so well up to present day and highly miss the productive 
days back then. 
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Prior to getting a confirmation from a Team Member of the actual owner of the portal at the 
time Dancho quickly began entering into negotiations about a possibly paid including a free 
venture at the time where he could earn a small commission for producing a high-quality 
security newsletter and actually be responsible for all the security and hacking content at 
Astalavista.com on a monthly and daily basis. As he began working on the monthly 
newsletter the first issue including the remaining twenty six issues which he produced over a 
period of three years were quite a success including the actual Geeky Photos section where 
portal users could send in photos of their desktop computers for the purpose of featuring 
them at the Web site potentially promoting their desktop setups to our audience at the time 
eventually leading him and the portal to win a PCMagaine Top 100 Security Sites Award back 
in 2005. Among Dancho’s main responsibilities at the time where the daily updating of the 
portal with high quality security documents tools and presentations including actual hacking 
and security links and overall responsibility for all the content at the Web site including the 
production of a highly popular security newsletter at the time including to actually answer and 
work on possible partnership and advertising inquiries at the time which led to a successful 
repositioning of the portal as one of the primary information security portal services online. 
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Jessus. Who would have thought? At a specific point in my time and my career as a 
cybercrime fighter and cybercrime researcher including OSINT analyst and threat intelligence 
analyst at some point in time after approximately a decade in fighting bad guys and actually 
tracking them down and exposing their infrastructure | finally got a very interesting email 
which was basically a screenshot courtesy of a Russian Business Network franchise member 
that was basically showcasing ownership over their primary domain which was nearly 
impossible to receive and in specific the fact that the original and primary Russian Business 
Network franchise domain name doesn’t really exist in the context of having virtual no clues 
of its online existence which was quite a remarkable success in the context that it would have 
motivated many to pursue a pension in the field which basically included the actual message 
saying “hi” and greeting me which was quite a success at the time in the context of receiving 
a personal message from the Russian Business Network franchise proving ownership of their 
primary domain name. How did | originally stumbled upon the Russian Business Network? It 
was by going through other people’s research on the topic and basically by doing my job at 
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the time which was quite a success in terms of daily monitoring for malicious and fraudulent 
online activity which led me to stumble upon their malicious infrastructure on numerous 
occasions in specific to find out more about their rogue and malicious bulletproof hosting 
infrastructure which used to dominate the threat landscape at the time in terms of popularity 
and the primary bulletproof hosting provider for a variety of cybercriminals internationally. | 
was also originally inspired by the usual source of inspiration for me which was basically 
iDefense actual threat research reports at the time that were basically going a step beyond 
the typical threat intelligence reports and were basically including all the necessary and 
in-depth details on various cyber threat actors at the time including primary sources of 
cybercrime activity internationally. 
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From: gregehbgary.com 
To: dancho.danchev@gmail .com 
Date: 2009-84-15 13:02 


Subject: Dancho, HBGary is interested in talking w/ you about Threat Intelligence 


Dancho, 


y company, HBGary, is developing a new business unit which we call “Global 
Services". A keystone of the offering is tracking human ond organizational 
factors behind malware threats. Your work, and some of the work of your 
peers, seems to be very good analysis in this ares. Since the space is new 
to us, I want to tep the best minds in the industry to help us develop ar 
offering. Would you be interesting in spending some time with our 
discuss your work and methodology? On the market side I am also trying 
pin down what customers will actually pay for, and perhaps you have some 
insight here as well. I am willing to hire you as a consultant, and/or pay 
for your time and travel in any way that works for you. I will be at RSA 
next week, and our company has an event for customers in San Jose in the 


first or second week of May. I also travel to Washington DC quite alot. 


Among the first things that | did prior to trying to pop up online back in full speed and fashion 
was to quickly built a set of projects including to launch several popular and interesting 
initiatives such as for instance Law Enforcement and OSINT operation called “Uncle George” 
where the ultimate goal was to collect as much publicly accessible information on the bad 
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guys then data mine and present my findings to the wider security industry and community 
including to look for and present tons of actionable intelligence on the bad guys which could 
have been useful in the context of having vendors and organizations attempt to launch cyber 
attack and cyber campaign attribution efforts against these individuals. 


At some specific point in time | came across the local for Bulgaria Cyber Security Talks event 
where | applied to make a presentation which got accepted which led me to eventually pop 
up at the event in front of eighty people and make a high-quality personal presentation on 
cybercrime research OSINT and threat intelligence including my general experience in the field 
as an expert in the field of cybercrime research OSINT and threat intelligence gathering where 
I’m an independent contractor since practically December, 2005. 


It used to be a moment when | originally started getting involved in OSINT (Open Source Intelli- 
gence) as an independent contractor when | originally came across to the following document 
which greatly inspired me to join this space - “Reexamining the Distinction Between Open Infor- 
mation and Secrets” while browsing through Globalsecurity.org Fas.org Cryptome.org at that 
time. The primary reason why OSINT inspired me to become an independent contractor in this 
space in specific information security is the fact that a lot of the documents that | had to go 
through to learn what OSINT is and how to do it were either classified or publicly accessible 
however coming from important sources of information such as for instance the CIA.gov includ- 
ing various other U.S Government and U.S Intelligence Community sources of information. It 
is my opinion that the power of OSINT primary relies on the actual collection and working with 
the actual decision-making information using public sources which also includes actual enrich- 
ment and colleration between multiple sources of publicly accessible classified and declassified 
information which makes this area quite interesting to join from an independent contractor per- 
spective in the information security field. 
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At a specific point in time | must have gathered a proper momentum among my readers which 
| never really knew anything about including the bad guys in the context of intercepting a 
chatter mentioning me in a pretty bad context despite the fact that this is untrue as most of 
my research and the research that | did was in a passive mode namely | never really engaged 
anyone in specific friends and colleagues from the industry including the bad guys as I'ma 
firm believer that you can collect all the information that you need on them without bothering 
to interact or approach them. Among the few key comments that I’ve ever came across to 
referencing me in my entire career on a major cybercrime-friendly forum community was a 
Darkode discussion including a hitman request for me which apparently managed to find me 
one way or another including a second discussion which basically referenced my name and 
insisted that the same thing that took place with me back in 2011 will happen again. What 
really took place back in 2011 in my apartment in Sofia where | relocated on my own and where 
| insisted to live on my own and do my research using my ZDNet salary as a primary means to 
pay for my rent and living expenses is. 
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The primary reason behind this post is to tell my story with all the juicy details up to present 
day and actually offer an in-depth and never discussed before perspective on my research in- 
cluding to present and communicate the crown jewels of my research to a vast and growing 
network of readers internationally where the ultimate goal would be to properly present the 
true story behind my professional career including to offer an in-depth peek inside my teenage 
hacker years experiences while properly present my story up to present day where I’m an inter- 
nationally recognized cybercrime researcher security blogger and threat intelligence analyst. 
Dancho Danchev Presenting at CyberCamp 2016 in Spain How did | attempt to take down the 
Koobface botnet? Who’s Hilary Kneber? What was the primary idea behind “Keeping Money 
Mule Recruits on a Short Leash” blog post series? How did | prevented and actually detected a 
possible kidnapping attempt? How did | made it to the GCHQ with the Honeynet Project? Is is 
true that I’ve received an invitation to present at Canadian Intelligence Services? What’s my 
professional experience with my current employer WhoisXML API? 
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Dancho Danchev 


| never really bothered to stop publishing content on my personal blog which | felt is an obliga- 
tion to the society and my readers who | really Know nothing about in the context of presenting 
my knowledge and they will come and in the context of never really bothering to set up my 
Google Analytics property properly where | was sticking to basically monitoring my RSS Feed- 
burner subscriber account which at the time peaked at 7,000 RSS readers on average on a 
daily basis which is quite a success for one man operation that never really bothered to know 
anyone from the industry in the context of basically presenting my findings and knowledge and 
later on getting surprised in the context of having folks and people from the industry approach 
me to say hi invite me to attend a conference share information or ask for information where 
I’m always there to appreciate their research and knowledge and continue to contribute with 
research and knowledge on my personal blog. 
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Vavigation Path 


Date Time WebPage 
13th November 2007 13:46:57 


13th November 2007 14:10:12 


13th November 2007 18:03:10 


How did | attempt to take down the Koobface botnet? Who’s Hilary Kneber? What was the 
primary idea behind "Keeping Money Mule Recruits on a Short Leash" blog post series? How 
did | prevented and actually detected a possible kidnapping attempt? How did | made it to 
the GCHQ with the Honeynet Project? Is is true that I’ve received an invitation to present at 
Canadian Intelligence Services? What’s my professional experience with my current employer 
WhoisXML API? 


What does rocking the boat really means? If it’s going to be massive it better be good. At some 
particular point in time when | was busy working on my personal blog | remember a moment 
when every day’s story used to dominate my life being in particular the fact that I’ve managed 
to tell a story for the purpose of sharing it and reaching out to my readership which at the time 
| was hoping that it was growing with several high prole daily users that | was busy tracking on 
a daily basis. 


The juicy details? At some point in time when | was originally secretly monitoring who was 
visiting my blog using Statcounter.com where | was hoping to see someone famous I’ve noticed 
that! got a regular visitor from The Pentagon who was basically visiting the blog on a daily basis 
during not necessarily a specific time but in general which was great news and this greatly 
motivated me to continue posting high-quality research and news and commentary articles on 
various events that took place in the security industry including across the globe. 


| also got several visitors from the CIA, the NSA including the FBI the NYTimes and BBC which 
was an outstanding audience at the time which was quite interesting to monitor and interact 
with at that time through my daily blog posts on a variety of interesting and high-quality topics. 


Up to present day I’m a 38 years old security blogger OSINT analyst and threat intelligence an- 
alyst from Bulgaria. I’m currently running one of the security industry’s most popular security 
publications which is my personal blog-Dancho Danchev’s Blog-Mind Streams of Information 
Security Knowlwedge. I’ve been running my publication since December, 2005 and throughout 
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the years | had an overage of 7,000 RSS feed subscribers including 5.6M page views throughout 
the years making my blog an extremely important switchboard to the world of security blog- 
ging OSINT research and analysis threat intelligence analysis and most importantly cybercrime 
fighting research and analysis. 


I’m also acting as a DNS Threat Reseaarcher at WhoisXML API. 


Among my key accomplishments include my "lawful surveillance" and "lawful interception" ex- 
perience as teenage hacker the production of the popular Astalavista Security Newsletter circa 
2003-2006 including the "take-down" of the Koobface botnet [MP3] including a participation in 
Top Secret GCHQ program called "Lovely Horse" including regular appearance in major news 
publications for interview and expert opinion including Techmeme, ZDNet, CNN, PCWorld, SC- 
Magazine, TheRegister, NYTimes, CNET, ComputerWorld, H+Magazine and regular security and 
research presentation appearance at major security events at GCHQ, Interpol, InfoSec Europe, 
RSA Europe and CyberCamp. 


I’m an internationally recognized expert in the field of cybercrime fighting and threat intelli- 
gence gathering having actively pioneered my own methodlogy for processing threat intelli- 
gence which leads me to a successful set of hundreas of high-quality anaysis and research 
articles published at the industry’s leading threat intelligence blog-ZDNet’s Zero Day, Dan- 
cho Danchev’s Mind Streams of Information Security Knowledge and Webroot’s Threat Blog 
with his research featured in Techmeme, ZDNet, CNN, PCWorld, SCMagazine, TheRegister, NY- 
Times, CNET, ComputerWorld, H+Magazine currently producing threat intelligence at the indus- 
try’s leading threat intelligence blog-Dancho Danchev’s-Mind Streams of Information Security 
Knowledge. 


With my research featured at RSA Europe, CyberCamp, InfoSec, GCHQ and Interpol | con- 
tinue to actively produce threat intelligence at the industry’s leading threat intelligence blog- 
Dancho Danchev’s-Mind Streams of Information Security Knowledge publishing a diverse set 
of hundreds of high-quality research analysis detailing the malicious and fraudulent activities 
at nation-state and malicious actors across the globe. 


Key achievements include: 

- Presented at the GCHQ with the Honeynet Project 

- SCMagazine Who to Follow on Twitter for 2011 

- Participated in a Top Secret GCHQ Program called "Lovely Horse" 

- Identified a major victim of the SolarWinds Attack-PaloAltoNetworks 
- Found malware on the Web Site of Flashpoint 

- Tracked monitored and profiled the Koobface Botnet and exposed one botnet operator 
- Made it to Slashdot two times 

- My Personal Blog got 5.6M Page Views Since December, 2005 

- My old Twitter Account got 11,000 followers 

- | had an average of 7,000 RSS readers on my blog 


- | have my own vinyl "Blue Sabbath Black Cheer / Griefer- We Hate You / Dancho Danchev Suck 
My Dick" madeby a Canadian artist 


- Currently running Astalavista.box.sk 
- | gave an interview to DW on the Koobface Botnet 
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- | gave an interview to NYTimes on the Koobface botnet 

- | gave an interview to Russian OSINT 

- Listed as a major competitor by Jeffrey Carr’s Taia Global 

- Presented at the GCHQ 

- Presented at Interpol 

- Presented at InfoSec 

- Presented at CyberCamp 

- Presented at RSA Europe 

In the past I’ve been a member of: 

* A Member to Warlndustries (http://warindustries.com) 

* List Moderator at BlackCode Ravers (http://blackcode.com) 
* Contributor Black Sun Research Facility (http://blacksun.box.sk) (BSRF) 


* List Moderator Software Contributor (TDS-2 Trojan’ Information Database) 
(https://packetstormsecurity.com/files/25533/tlibrary.zip.html) DiamondCS Trojan Defense 
(http://tds.diamondcs.com.au) 


* Contributor to LockDownCorp (http://lockdowncorp.com) 
* Contributor to HelpNetSecurity (http://forbidden.net-security.org) 
* A Security Consultant for Frame4 Security Systems (http://frame4.com) 


* Contributor to TechGenix’s WindowSecurity.com (http://www.windowsecurity.com/authors/d- 
ancho-danchev/) 


* Technical Collector-LockDownCorp-(https://lockdowncorp.com) 

* Managing Director-Astalavista Security Group -(https://astalavista.com) 
* Security Consultant-Wandera -(https://wandera.com) 

* Threat Intelligence Analyst-GroupSense-(https://groupsense.io) 

* Security Consultant-KCS Group Europe-(https://kcsgroup.com) 

* OSINT Analyst- Treadstone71-(https://treadstone71.com) 

* Security Blogger-Armadillo Phone-(https://armadillophone.com) 

* Security Blogger for ZDNet (http://www.zdnet.com/blog/security/) 

* Threat Intelligence Analyst for Webroot (https://www.webroot.com/blog/) 


| would like to thank the following people for contributing to the Scene throughout the 90’s up 
to present day and for keeping up the good work part of Astalavista.com’s Security Newsletter 
which | produced circa 2003-2006. 


* Proge- http://www.progenic.com/ 
* Jason Scott-http://www.textfiles.com/ 
* Kevin Townsend -http://www.|tsecurity.com/ 
* Richard Menta-http://www.bankinfosecurity.com 
* MrYowler-http://www.cyberarmy.net/ 
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* Prozac -http://www.astalavista.com/ 

* Candid Wuest-http://www.trojan.ch/ 

* Anthony Aykut-http://www.frame4.com/ 

* Dave Wreski-http://www.linuxsecurity.com/ 

* Mitchell Rowtow-http://www.securitydocs.com/ 
* Eric (SnakeByte) -http://www.snake-basket.de/ 
* Bjorn Andreasson-http://www.warindustries.com/ 
* Bruce-http://www.dallascon.com/ 

* Nikolay Nedyalkov-http://www.iseca.org/ 

* Roman Polesek-http://www.hakin9.org/en/ 

* John Young-http://www.cryptome.org/ 

* Eric Goldman -http://www.ericgoldman.org/ 

* Robert-http://www.cgisecurity.com/ 

* Johannes B. Ullrich-http://isc.sans.org/ 

* Daniel Brandt-http://google-watch.org/ 

* David Endler-http://www.tippingpoint.com/ 

* Vladimir, 3APA3A-http://security.nnov.ru 


In this video I’ll discuss in-depth a variety of personal projects and current and ongoing both 
real-time current and historical research and analysis activities in the following categories such 
as for instance: 


- My Dark Web Onion 

-My Uncle George Law Enforcement and OSINT Enrichment Operation 
-My Cybercrime Forum Data Set 

-My Unit-123.org E-Shop for Intelligence Deliverables Project 

-My Offensive Warfare 2.0 Threat Intelligence Clearing House Project 
-My Disruptive Individual’s Threat Intelligence Feed 

-My Current work as a DNS Threat Researcher with WhoisXML API 
-How | ended up in Snowden’s Archive?a 

-How | ended up on Wikileaks? 


-How | made it into several comparative academic studies on the quality of sharing threat 
intelligence and cybercrime research information? 


-How come I’m the only one listed as a competitor in Jeffrey Carr’s Taia Global Competitors 
Slide? 

-What’s it’s like to run the infamous Astalavista.com portal back in 2003-2006 where | was 
acting as a Managing Director? 

-What it’s like to get the privilege to work as a security blogger at ZDNet’s Zero Day blog for 
four years? 
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-What'’s it’s like to work as a security blogger with Webroot for two years? 
-How | ended up and spend the last couple of years doing OSINT on the bad guys? 
-How | ended up having a project on the infamous Astalavista.box.sk? 


-How | ended up having a mobile application? 
-How | ended up having a personal memoir? 
-How | got busted? 

-What it’s like to visit the GCHQ? 

-What it’s like to meet the security industry? 
-What it’s like to visit RSA Europe 2012? 

-What it’s like to visit InfoSec 2012? 

-What it’s like to visit CyoberCamp 2016? 

-What it’s like to get an invitation to visit Canada’s Security Service? 
-My DIA Needpedia Investment Proposal 

-How | ended up discovering a SolarWinds victim? 


-How | ended up with a real-time OSINT and cyber attack attribution campaign on the Conti 
Ransomware Gang? 


-How | ended up almost retiring and offering OSINT and threat intelligence training? 


H 
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1.2.16 Exposing the Web’s Most Prolific Malvertising Operation Circa 2009 - Exclu- 
Sive (2023-04-28 17:24) 


http://logiagraup, checkm8. com/data/479231/HP_300x250.: 
http://logiagroup. checkm8: com/data/478089/HP_ 728x901 sy 
http: //imagec05, 247realmedia.com/RealMedia/ads/Creative 
http://cache.fimseryvecdn.com/contents/209/298/298209/C 
http://barnner. pando.com/adimage. php ?filename=skyauction 
http:4/cache, fimseryecdn. com/contents/209/298/298209/C 
http://cache. fimservecdn.com/contents/209/298/298209/C 
http: //imagecO5, 247tealmedia.com/RealMedia/ads/Creative: 
http://perfect-banner, com/www/images/rhapsody300%250-1y 
http://cache, fimservecdn. com/contents/209/298/298209/C 
http://cache. fimservecdn.com/contents/209/298/298209/C 
http://cache.fimseryvecdn.com/contents/209/298/298209/C 
http://deMF. opt. fimserve.com/adopt/?r=hil=1 1500000%.pUn 
http:#/cache, fimservecdn. com/contents/209/298/298209/C 
http://cache.fimservecdn.com/contents/209/298/298209/C 
http: //deMF, opt fimserve.com/adopt/?r=h&l=11011021&pUn 
http://www. howtoforge. com/measuring-linux-latency-with-late 
[1] http://www. tradingmarkets. com. site/news/S tock20N ews! 


Who remembers the 2009’s malvertising campaign (hxxp://trueconv.com) on the NYTimes and 
ESPN including FoxNews at the time which was dropping scareware also known as fake security 
software on the hosts of affected users who appear to have clicked an interactive advertise- 
ment on some of the Web’s most popular web sites at the time part of a rogue and sophisticated 
malvertising operation courtesy of Russia-based cybercriminals at the time who were monetiz- 
ing the fraudulently obtained and hijacked traffic using a scareware affiliate based network at 
the time? 


Keep reading. 


As | spent some time going through my old threat intelligence archive circa 2009 | found a 
crown jewel part of my research at the time which could be easily considered a must process 
enrich track down and analyze malvertising operation up to present day where I'll do my best 
to assist everyone by sharing as much information regarding the Trueconv.com malvertising 
operation at the time including affected parties the actual URLs and domains known to have 
been involved in the campaign including related IPs and will do my best to speed up everyone’s 
work in terms of further processing and analyzing this campaign by using known historical 
OSINT processing and enrichment techniques. 


[2] 


The good question? How | got this data? It’s be figuring out a way to access access the publicly 
accessible statistics on the primary Trueconv.com malvertising operation domain circa 2009 
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which leads me to today’s analysis of what appears to be the Web’s most prolific malvertising 
operation on a wide scale circa 2009. 


The research in this post can be easily considered the malvertising market segment’s largest 
OPSEC failure even since it’s growth stage back in 2009 where the primary infection vector 
here was clien-side exploits and social engineering and where the most affected and targeted 
operating system was Windows XP where I'll do my best to offer as much historical and ac- 
tionable intelligence on Trueconv.com’s true widespread campaigns back in 2009 by offering 
a complete listing of all the actual URLs involved in the campaign including the associated 
domain names and affected IPs based on publicly obtained back then misconfigured access to 
their entire logs database which easily proves to be an invaluable wealth of information on the 
most prolific malvertising market segment operation back in 2009. 


[3] 


Email address accounts seen in the log files: 
22info@cafesferraz[.Jcom 
-itsrainingforyou@gmaill[.Jcom 
acummings@paulding[.]k12[.]ga[.]us 
belew@comcast[.]net 
20itsrainingforyou@gmail[.Jcom 
taffytiffany@yahoo[.]com 
mwdsmanagement@coxinet[. ]net 
royalcrackerzzz@gmail[.]Jcom 
cubilonsa@gmail[.]Jcom 
20royalcrackerzzz@gmail[.]Jcom 
jxpecaban80@hotmail[.Jcom 
paraexca@globetrotter[.]net 
www@oprah[.]com 
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xpcar 003@live[.]Jcom 
contact@parc-vxpges-nord[. ]fr 
cjn@justice[.]gou[. fr 
susan@susanforrest[.]com 
Scottsmbnt@aol[.]com 


scorpioascendant@hotmail[.Jcom 


IPs seen in the log files presumably the actual victims of these campaigns: 
74[.]125[.]47[.]132 

93[.J175[.]232[.]154 

76[.]88[.]137[.]98 

141[.]151[.]8[.]158 

193[.]178[.134[.138 

58[.]65[.]245[.]234 


152[.]13[.]71[.]24 
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98[.]161[.]15[.]161 
131[.]118[.]124[.]167 
71[.]226[.]92[.]54 
75[.]185[.]213[.]12 
75[.]183[.]68[.]64 
76[.]31[.]128[.]166 
96[.]238[.]184[.]188 
69[.]86[.]199[.]68 
64[.]83[.]248[.]84 
74[.]255[.]195[.]114 
75[.135[.]242[.]17 
98[.]166[.]33[.]128 
66[.]56[.]233[.]79 
76[.]226[.]11[.]79 
71[.]169[.]141[.]118 
67[.]142[.]162[.]29 
24[.]44[.]162[.]69 
76[.]116[.]61[.]212 
168[.]16[.]193[.]126 
199[.]227[.]146[.]82 
173[.]21[.]59[.]245 
71[.]226[.]132[.]134 
67[.]11[.]245[.]57 
64[.]26[.]97[.184 
68[.]46[.]43[.]26 
65[.]11[.]141[.]87 
72[.]65[.]156[.]146 
12[.]14[.]199[.]234 
67[.]243[.]42[.J115 
173[.]16[.]28[.]182 
67[.]166[.]227[.]243 
96[.]238[.]93[.]124 
75[.]185[.]155[.]89 
67[.]176[.]141[.]242 
98[.]166[.]139[.]228 
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24[.]58[.]111[.]195 
72[.]72[.]214[.16 
68[.]197[.]139[.]65 
71[.]41[.]177[.166 
74[.J176[.]184[.]48 
68[.]191[.]9[.]132 
69[.]27[.]229[.]11 
96[.]39[.]175[.173 
74[.]166[.]122[.]66 
24[.147[.]5[.]144 
12[.]52[.]253[.]141 
168[.]13[.]223[.]66 
76[.]15[.]21[.]232 
71[.]199[.]237[.]16 
24[.]59[.]159[.]225 
74[.]184[.]254[.]231 
69[.184[.]97[.179 
98[.]28[.]132[.]126 
134[.]68[.]178[.]159 
12[.]215[.]211[.]251 
75[.]128[.]2331.]94 
69[.]245[.]151[.]66 
24[.]213[.]149[.]122 
216[.]79[.18[.13 
98[.]219[.]216[.]132 
66[.]194[.]51[.134 
174[.]48[.]228[.]16 
24[.1173[.149[.184 
74[.]239[.]136[.]252 
125[.]161[.]216[.]144 
68[.]236[.]118[.]222 
99[.]159[.]79[.]156 
137[.]45[.]146[.]171 
98[.]215[.]126[.]227 
68[.]62[.]51[.]216 
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69[.]246[.]155[.]35 
71[.]197[.18[.]146 
125[.]161[.]245[.]28 
98[.]197[.]197[.]98 
68[.]32[.]145[.]172 
76[.]187[.]248[.]67 
76[.]24[.]45[.]195 
96[.]238[.]95[.]191 
124[.]195[.]6[.]121 
74[.]71[.]145[.]82 
98[.J222[.]13[.]248 
96[.]237[.]238[.]126 
24[.]247[.]252[.]192 
24[.]94[.]252[.J121 
74[.]44[.]165[.]4 
71[.]71[.]89[.]227 
24[.]99[.]66[.J224 
76[.]25[.]26[.]133 
162[.]127[.]32[.]57 
74[.193[.]214[.]33 
68[.]196[.]27[.]59 
69[.]136[.]233[.]59 
96[.]243[.]236[.]227 
76[.]113[.]95[.]131 
71[.]239[.]162[.]32 
68[.]42[.]93[.]143 
75[.]167[.]177[.]58 
72[.]187[.]45[.]78 
69[.]123[.]52[.]94 
24[.]61[.]17[.]48 
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an4hGzjLzgoSjc_AQ3TFkUtH41PrsUZGu2nvmiBVbhDenGBf sFGIu: 
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1.3 May 


a 
Y 
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Exposing the Ukrainian Insider Trading Hackers that Stole $30M Using a 
SEC’s EDGAR Securities Fraud Scheme - The Technical Details - Exclusive 
(2023-05-01 14:23) 


[1] 


"An OSINT conducted today is a tax payer’s buck saved somewhere". 

Official U.S Secret Service [2] $1M reward listing on [3]U.S Secret Service’s Most Wanted Cy- 
bercriminals List for "[4]Oleksandr Vitalyevich leremenko". 

Handle: Zl0m; Lamarez; Ded.MCz; |@m@rEz 


Email: lamarez@mail.ru; uaxakep@gmail.com - xeljanzusa.com - 62.109.25.228 
(https://www.secureworks.com/research/point-of-sale-malware-threats); 62.109.1.69 
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Uaxakep@amall.com 


xeljanzusa.com 
[5] 


Commpany: 2016 K3epoKc 

Phone: +7 951 366 17 17 

ICQ: 123424 

Web Money: 258807111393 

Related URLs: 
hxxp://ageline.ru/lamarez.php 
hxxp://kOx.ru/md5.salt.tx 

hxxp://kOx.ru/ _bot.exe - 82.146.60.59 
hxxp://kOx.ru/black energy 31337 /stat.php 
http://kOx.ru/siicywu36dswh/addddos.php 
hxxp://xtoolz.ru 

hxxp://cup.su 


hxxp://xwarez.us 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEiRnzwKaQ8VexF 1mDf3NTOjvLDSCpkceYKIu4hiVSHK3£Qdo 
HX19BhQ j 3BK1VVypohCIf6bjOqlh3hxuf o5DVi99yc5Fdaxj8vite 
2 


https://www.justice.gov/usao-nj/pr/nine-people-charged-largest-known-computer-hacking-and-securities-fra 


3. bttps://www. justice.gov/usao-nj/pr/two-ukrainian-nationals-indicted-computer-hacking-and-securities-fra 


d-scheme-targeting 


4. https: //www.secretservice.gov/investigation/mostwanted/ieremenko 
5. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEhptksUVr VF ixFL7 QyPC4HCR8vakuDrOPFt1lUgYBZdimmBPB 
SXbkGrrrpWdtpwHkmCOWCppH2ndGHdwyPBdhv6S-UTkt616zmDwIEa 
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1.3.2 Who’s Behind the Butterfly Bot/DCI Bot/DownTroj/Aspergillus Botnet Malicious 


Software? (2023-05-02 21:17) 


[1] 


@ @ @ 


leniqi.mentor@siol net wa, fatal@armaill_com addresshamlett 91 7@hotmail.com 


deepbluesecurity.nl voce.cash 


[2]Awesome. 

Emails known to have been involved in the campaign include: 
iserdo@gmail.com 
toadmin@133/7crew.info 
wg.fatal@gmail.com 
emailedgov.hacN@gmail.com 
admin@1337crew.info 

jernej 5@hotmail.com 
usediserdo@gmail.com 
toiserdo@gmail.com 
schlist90210@gmail.com 
Waisted.time@hotmail.com 
addressnetNairo@hotmail.com 
betweennetNairo@hotmail.com 
hamlet1917@hotmail.com 
addresshamlet1917@hotmail.com 
withhamlet1917@hotmail.com 
floxter@hotmail.com 
ice@iceman.in 
addresslenigi.mentor@siol.net 
lenigi.mentor@siol.net 
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accountiserdo@gmail.com 
addressicemangjN@hotmail.com 


Sample screenshot: 


[3] 


@ @ @ 


floxter@hotmail.com leniqi mentor@siol, net wa fatal@gmail.com 


®) 


deepbluesecurity.nl 


®) 


threatforce nat 


® 


are20collectorcom 


Related domains: 
hxxp://voc[.]cash 
hxxp://deepbluesecurity[. Jnl 
hxxp://erc20collector[.]Jcom 
hxxp://b2bradio[.]net 
hxxp://threatforce[.]net 
hxxp://intelhub[. Jlink 


Related screenshots: 


[4] 


©) 


yoc.cash 


Zany 
@) 


b2bradio.net 


®) 


intelhub.link 
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@ @ @ 


floxter@hotmall.com leniqimentor@siol net hamlet) 917 @hotmail,com 


¥ 
Sy) 
= 


tamiflux.net tamiflux.org 
25811 cec3daedb4386a541 abeasies82 aro 
>a) 
MSSRV32. EXE 
Related screenshots: 
[5] 
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@ @ 


ice@iceman.in addresshamlett 917 @hotmail.com 


® @ 


®) 


albaname.com albaname.net mpuq.net 


Zany 
@) 
sibatindtnet 
Related domains: 
hxxp://voc[.]cash 
hxxp://deepbluesecurity[. Jnl 
hxxp://erc20collector[.]Jcom 
hxxp://b2bradio[.]net 
hxxp://intelhub[. Jlink 
hxxp://albahost[.]net 
hxxp://albaname[.]com 
hxxp://mpug[.]net 
hxxp://albaname[.]net 
hxxp://threatforce[.]net 
hxxp://tamiflux[.]net 
hxxp://tamiflux[.]org 


Sample screenshot of Voc Cash: 


[6] 


@ 


schlist90210@gmail.com 
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Our 


the information below 


1. fitapa;/ blogger. googleuser content. con/ing/b/R25v22x0 /AVWRSE}6v anya jeaPaGLqSMVA00vw_SSTRETyIPuARCH 
2, hetps://wuv. justice. gov/opa/i16/630841,/download 

3, hvtpe://blogger .googleusercontent ,con/;ng/b/829vZ2z1/AVWXab j bakers 40sKOSFESVaN2Le~aGbVSecby7@PjHInBiLAd 
4. https: //blogger. googleusercontent.on/ing/+/R29v22x1/AVwKsEiaq6LvOVaN jPe=x20GBRCTSDEOLBIPtaOhnescalivaE0 
5. https: / blogger .googleuser content. con/seg// R29v2Z2n1/IVWISELB-DqRerDRxScDe j8-SOKyRqLiNGc_9jAuPGpOSEENDAR 
6. hicnps://blogger .googleusercontent con/sng//R20vZ2n1/AVWSE SB jaATe4TIQhpg@i TlaDrbéakOF VLvezs7acZ73-10 


1.3.3. How Do Cybercriminals Manage Compromised Hosts Using Desktop Manage- 
ment Applications? - An Analysis (2023-05-03 20:42) 


Re 


[1] 


Xe) 
Oo 


7 


Knwent. Hactpoiiku coxcucuxayin, Settings. 


Hactpoliar COnciapHKaTODS PAI ARNO! He ABS pAaAena - Connections is Modules 
fons Direct connections 1 Deny connections cogepwat COOTESTC TRE HO CrHEIat 
Pesseina aaa sete sareeen contain COMM CDE) Mt RANDOM COW Atatnre, 


Farah ot piace pinay creagyraned) popes: 
ny ] dst_addr dst_mask [op dst_port] 


[e=usertist) = MEOOSSBTE MMOS MONE ~ COMCOK MOMSOBSTONEN CHCTEMbE 

prevgeeoll = P-OANeC WP DOPMATE EEX oex Kee (anpierp: 192. 166,0.0) 
~ Macks ¢ dbopmste ecccoxsonocn (Hanpumep: 255 255, 255.0) 

Rote perth “HECOAISTENHO NON — NOP) HaSHAYONMA (HaNpHMEp 239 ANA NetSios) 


creat Moaynel noAnexaaypa(include modules) He 
) pommel 


Beavane Include modules coaepeim GAH) CTpOKy CO 3ee2AOWAI, WTO CaKe4seT 470 \ 
COMCIDIEp Gey NOANENaTe ECS IpMNOeeHiA 


Noche pegsrhiposswiaa mofse none HeoGegumo HaitaTe wHonky | App wrndes 
Mameneroa Scrynmin 6 cry HeMegneHeo, unt [Undo | — ane otmedel caenaoeix 
MCTIPSSNeHiNt. 


If an image is worth a thousand words then check out the following which although released 
in 2006 appears to be one of the cybercrime ecosystem’s most sophisticated and advanced 
compromised hosts management tool within the ecosystem up to present day. 


Sample screenshots include: 
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Knvent. Komanabi. (TonbKo ana yposua admin) 
KOT MOSGONAST OTOL NTs HOM N tte! Gotan MON 4ST PODYMETSTh/ He GENO Here" 


© paarkeom epeneres, Komaan mary? GexTe ¢ napaMerpanue it Gea napamerpoe. Kpame Sat 10) Disconnect pes pars ¥SQ 
STOO OCT HOEOD APSHA ONDA ARNOWHN KOMIMA, HOTODRAD HAMMMICTON C ChBOra = Jos! 
TOMEam 1 ACCTYNHe! WETeS EUHTRYCTHOd Meio Critters BOToS (MpSseEie KIM He Create) st al 
PING ~ OTPAEP Tk bxO-RaNpOC Ae 
JRUN ~ 30 PYSITE M BEFIOMHUTE thal Nepe gant enveHTOM 
JRUN Tporams] = AONYCraRT TAX Me yKaDoFAe NApAMATPOD ANA DanyCKa@eMoro chaina Selected | mare | | 
GET patty —honywet dain c dota; path — cyte « datiny 4a Gore 
PUT path ~ Tepes Sin Gory ¢ yeasatem MYTH PaSMEUssHHA Mt MMeHit 
DeLaOT ~ YAaNitTte Gora 4 BCE ero Che Abi C MALI! 
DELBOIPROT - yganems Sota ¢ HOBOS MEORHOC TLIO NEE TOPHON ycTaHnEN4 
KOMOH Ai! MOF Y? OTNDAENI TCH TarOhe criMcxy Goran (or. paaen Comox Goros. Poymer). 
Row NPMMEp HCNOMmsCSsHiMA MOMaHel! 3TO OTTpsexa enMaHAL! PING cecry force. 
PasynutaT BEMONWEHW AONWENM fbi Gaped cory~ay-Abe 8 Gao OTHeTa CMD_OK B& 
nocne AH KONOHRE CreecKa Boros, KOTOpaA VeMeHuUT Ceol saroncece Ka Response 


Man | Moddes | Traffic expert | Connections | suttngs | 


wane D612 +2M 


renee 


Sa ly ee oe) 


GH.197.155.197 
Sane 1 wan | 


Eres parame, proves [bem ru wail be ertint fe tees Ble Pew rand set nie om rere vain 
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wettitaauuz).-8 


SacasEMweEss 


i EN 


enim 
Tom ompacre Komaxa RUN, GET, Pur Bpywiyo - HeodsDaneo 
YEG Te MOCN® KOMAM An HOO RO AMP G7 MANSMETPe! W HiKaTe morKy | Send 
TEGNE 4OFO KNOT MOMOOCHT WATE: MOKA Hes chain ANH OTNOSENS OFM >TO HHO, 


CYULeCTByeT Bog MOwHOC Te Se TOMA THUEOCOR OTD aeS) KOM, BOOM HOBRIM NOMBIMHOLIUMMCA 8 Crivoe Coram, [Ina store chymut dinar Auto send this command to new bots 
OvHO MOMMSHA "PAHEIT THONG JCTOPIGO OTNGSBTSHHieX WOMAHA, ANE NPOCMOTDa NPeAbIA YUL MOND BOCNOTESCESTECA CTPENKAMM KTGRHATYP! BBEPx.SHIS MOO KHOMKaM B 
Elim KOMSHA0 48 NIDOAWECTBYST CliMBON «Towa», 10 GoT paccMaTpe@asT CrpoKy xan http url agper 4 meitaetcs Sarpylem™ devin C >TOro BA0eC8 ™ BeNOMinte Toone yaaworo 
BaTyCYS CKaueHHoro chalina eneeHT Tarcns Nonyuur orseT OMD_OK 

Tlocne B6inOrerkt MOMaH aD GET KniaT Nonywae;r Yeninom chal ¢ Cota w OTKpeataet Asanoroeoe OHO C BaNpOCOM MyTH Afut COmpaAHaHi NpHPUITONO (bana, 
\COonaHaa .PUT aeecteyst KaofopoT ~ gain repeaserca c RMmeHta 4 Npocto pazMeuyastcs Ke GoTe No yKazaHHOMy nyTM, Mocne SeinonHeHiMa KrikeHT MONysseT oT Gora CMD_OK 
DELBOT danycraer pexiint Camnyiaa rowmedian GOTe. NDOMCXOAMT YHMNTOKEHHE Sariteel DRECTDa, COpEMcOe, ApaiBepae, (haloes 1 BoCcTRHORNOHNe TOVeK Bx0Aa Windows API. 
DELBOTPROT adaricensia Komanae .OELBOT 2a WcxTnoveHie foro, sto >Ta KOMaMAa MOaMiteuHpyeT CHctemy Tesi ofpazoM, “TO NoATOpHas yCTaHOeNa Gota yxe HeaoaMorea, 
Fora+44 -REBOOT rpowseagie Heme aneHyyio mepesarpysiy CHeTEres, 
Mone Note / Response seietca seroma waco Npet NipewlMe CEST OS KOMAHA, BLOB OFHU Ne AuCTDORAMiKS KOMeeHT ap, fdlo BOYUH)O — Mp Krtee Mo BaroneHy Crone. 
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Knnent. Traffic Expert. 


B pes comorhrecn{ie* BO2MOMEH Mepexsar Tpadhies, fina sToro CoyKuT Bena are Traffic Expert, Reuonrorcs cneayoume auae Thaders 


Sended ~ TRAD, OTTIDSR NOHbIr NpHNcCeHiee 

fe csc. segs apees ny Fe scr} Cent v7.30) 

GETs ~ OTNPAD NSH SEMPIGM CTpariy (GET wOMaeua Nttp) 

POSTs ~ OTNIPAS NH Hue HaSOpe AaHHiIE C CRON. SCSSHveM FOMaH see POST oi 197. 169.199 — Disconnect Acoumt sa SG “ 
Haa Hite WuCMeoe ssa veHe-anaHs Nepe mavereit Aste, (Clear }ounctka Syrpepa, = cee adam x ) 


Pees: HEX- wee ta guarepeedait, TEXT \rexcy, WRAP - Text c nepenccom CTpoK, 


a0 Nowe belt Sets. 
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Knnent, [ipasiina, 


Kak CRARAHO Gbtlie: cielo ‘setueniads couiiiaeei . commonane siniehebem, ttesheaiien 
a 7aOwe JaMPenNsTs Sota 53 pan comat sets, 
310 MONO GIONITE, HETOMGIY# MOHIO COB AHMENH A, £1:1)iR2eNOe NO NOINCN Macrear Memes! 
Use module only with this Bot ID = aaeperpiT> MHencoeeHere 3a Gorcet 
Use module only with this Country - aaenenrt> NoMneoRe a8 CIpANOr 
Ponemo Store ecSMaHO GLUE 1 DYWHOe pEMeHeHeS Maen COnietemagn NpAncSHie 
Bknaara Modules cogeguatt cnvico™ pam! = copes Te. 
Module — Fete PUK Ee (KOX 8 CTaHMASpT MOM AcneT vee Ssaqau) 
Rule - (Bano 
BotHash = - paearneasi eos Gota. (Mcrormayetca ana mpseetr i¢ mOMMeHTapwes) 
Countries ~ cwcox CIpar sepas mpoden, fpummep: WS CA AU OP MO IN 
phere comand hi, coped apple each ceadhingbiase ogee Beene 
GaMana OpOCRaTpMESeT CNCOK Mpamrin. ECn GkFIOMHAIQUSe SaDOC MpunFEHS 
Heo © Fone Modules, To KmeHt HaxO ANT CooTeeTCEyuero Gota H McnonayeT ero 
ANA AatHOorg WOHHEKTa. Eon yrasaviiall Got We HAVE TO © CrMEXE COGAHHeHIAy 
SOTHNOGT eMOpTERIte SDHHBKT C ID=0, uepes MOTOpRit Tpagae He NpoROAuT it CeTeRO 


Tip! PY¥HOM paAakTMpObaHid Tipaein pone BotHash coaspeur noacKasy ¢ ID Gora, 
wOTOPOMy Cootserctayer yeasatHent rou, Kaw anit Got HMeeT Ceol yonicareHedt weul Ane 
Toro “cow @D mosHO feinD Towed HABHTIApMpOSaTS, Tak wax Bot_ID cywectiyer 
TONG Hi Bee OAHOR COCCHI Wt MOOT Galt HIHANOH BMOcNeAC TEM Apyromy Baty, 


exnousor 5 cela 28a Bapuanta | 


ANA COaAaHAd npseHine HeOOKDAuMO JanOniT Nona Module name, Rule i oar 10 
asy Monel: BotHash un« Countries list. Tain cfpasom noresiva PounoweHaa MoweT 
CCyWSECTENATECA Maio « ONpeAeneromy Gory, mGo  CMcKY CTpaH. BO BTOPOM CHyNae 
wenonesyetcs cMyNatHuA eeMop ¢ yMeToM dhanetpa, ech OW axTHmeH, Hanmue © crore 
eRe COGAMHENEN CTIpOK C ID=0 GRMASTeTeCTRyRT O HRECRMOKHOCTH BeINONHITh 
[pseino Coxorpeeauve npiirionedt; meio HeofaoguMoro Gota Het 6 aKnaiHe, nuo HeT 
HREOC MAMIE CTPA, 

Tlovt aediope Mpacana m3 CHUCKS aro ASH NOnaAwOT B Nona ANA pegaitposaiaden. 
Hawatve KMori SembiezeT ,obanne+e Mpseuns 43 None Hane 
WC OK, ~ YAANEHING BiISpAHHOrO NpaRita, ~ BCR. 


Ppt Nonwitre coa4ath Hoeoe npaekno c Module name ye CyWscTRyoWeM © creCHS 
Tosenn —eRuiatr ca NpeaynperasHie c EonpocoM oO Repesarescis, 


Quvio nowinoyerine Mower HiMeTe TOM OavO Mosman | 
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B AaHri0M pei BCe COARAM NpuNcneetos Se OO peat aT 
}T4SHTOM Mo OTOOpAKSOTCA © MMHEM ome Tone ID cogepwwt Homep Gora, 
mp one ana pea rae Beopay 6 one acer sa reg Twerubet eet et Ger 


Am porn ‘Honor ome poy cnOoMmadObaTLEA pre ene crpuaieinnt for. 
Powys! eiiiopa cnywaieorp Gata samncuserca 4 BbINTIONaETCR Haxatem Hore [ RAND] 
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Break this connection | = PADOPESTe eH PAHHOR CORAMO HIN 
Break all connections = PasOPESst= SCE CORAIHEHME 
Add module to exchide list ~HCKNOUMTs MpMnooReniee Hor Comte yKanyee 
Use madule only with this Bot ID = - saeperem: rpinowetee 33 Gorom 
Use module only with this Qauntry — - saxpenan Mpinomeiee 33 CrpaHol 
Ans )Npae fetes Npsesinar Npveaseo GoTos KnpeInoweHioant Mcnonesyercs Mocules 
Brrayka Modules CORERI4T CINCON NPSEMN, ROTOPee SETOMATHUBOG! CORDHAOTIN NDI 
SGRDEITIM KMMeHTa M BOCCTaHSE Mea TCA MPH sic Conc ecemoverni © Settings 
B One Sanna Ao Settings HaxOANTCS Ame Nona; 


Include modules =~ crecox Moaynew NOAnexaupe comeburayn 
Exclude moduaies ~ ChHCOK HOKmOGerani, (MMOS MOAY NE Kak ® AMCNeTvepe Baga) 


B Chyuae pywioro PeseT MPOBAHeN Hac Tpoex Ha axnagne Settings rentiroa_io Haare 
eHorey Apply (Geenxy) “totes yeeeeties Be TyTN B Cony HeMagneHio. 
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Knuent. Cnucox Goros. Ppynnei, Konmexrapun, 
Heenropeie CMepaLiias KrwHT MOET BANOMHATH C rpyrina Gore. 

Ans BbIAD NEHA TpPyMnet MOKEHD MCNOML Osa Te CNegpoupe KOMOVHaLIET | 

Shift + rmoauca * anGarneree & rpynny 

Ctrl + peeuxa ew 

Alt + seus 

mnaevant [A] [0} [7] ~ Soe Sammnatets acme (ellie romnor  emenicis tom, 
Bote, BXOAAUNE 6 fpynny OTMENaIOTCA BiAeneHeim None 1D 


None Note pai nores0BaTErecHil Teecr (eoMMeHTapinl) 
Ane GEC6a GO DEAIKTHPOBeHIH «KOMMEMTapAs = MaWOO 
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1D ~ DOULA CEPEEDION HOMOE), 190 MORINRIISICN na Bleed CoCcN, Co ae Hol TD, 

Note =~ norescestemoow noreersaree / Baieneen pew Response - orn|t ¢ Pea cmEtator orepauies 


—— fos] invita 
Une Sete | eave | sere] 
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1.3.4 Hacker Database (2023-05-07 16:37) 
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rm 


4c $ = ceaed 


| would like to take the time and effort and let you know about my latest project which is called 
[2]Hacker Database. Obtain access [3]here. 


Sample screenshots: 
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HackPhreak Group 
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Danger Security Team 


IDH Security Team 
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| ranhack Security Team 
NOPO Digital Security Team 
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Ashiyane Digital Security Team 
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Inst Security Team 
Mafia Hacking Team 


Bastan Security Team 
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IR Anonymous 
hima.perl 
Gat H4ck3r 
alimp5 
MR. Migpild 
Linx86: 
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BigB4NG 
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Sample visualizations produced using the database in GraphML format: 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEg6if pcxMIQSC JnCSdH9aA0s0c1dS jpEOb3TZjbIGOL4LOr0 
H8fjxIw55gvgJPe-t4p20qvbDeQiNEW3t-Svlk2sC4w5HQq5Alwgo 
2. https://cybercrime-maltego- graph. org/ 


a 


https: //cybercrime-maltego-graph.org/introducing-maltego-and- graphml-compatible-live-and-historical-hack 
4, https: //blogger .googleusercontent.on/ing/b/R2DvZ2x1 /AVXeEgENOWnSNTSvrSWfpToVUWCL vLKENZevl¥-AcygC94jm3nSt 


bcRpjF-sXXmkHRO6sEVnJ3NUy_xMtGSgzWQePPNZNOyu3PQgW1F7p 
6. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEgKD3YCtuJW81 g9wWqtzGezPyVVsC5IA37XTiFKPZDHkm3W 
PS1A523u1qHJBEEaKhVFEMrNF 1zVQ0aqI cbJyXpxkLem7y3VW-80 


7. https: //blogger. googleusercontent .com/img/b/R29VZ2x1/AVvXsEj bvnkcOBOs2UUEGK_tTY-9-fcNJ5BA7IfcfMxsvjOQNo0_p 
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5. https: //blogger .googleusercontent .com/img/b/R29VZ2x1/AVVXsEjpMV7PUwDQbsXwGGBOdP c8hKNWDOj1S3FOc4bMFnqfWYpti 


SN 


8. vtps:/ blogger. googleusercontent .con/ing/b/R29vZ2x1 /AVwKsE gGSHGRhx SH [THs 1BONiKDC_a7S0THEAR-QEHO0iiS% 
9, https: //blogger. googleuserconvent. con/ing/b/R2v22z1/AVwKsEgPVDSTOSECAF tx, BbAGarTith800ohiubFO#SEj yFkj6POd 
0. 


pay 


1.3.5 Happy Holidays From The (Not) Republic of Bulgaria - An Analysis - Part Five 
(2023-05-08 19:25) 


[1]Dipshit. The [2]deepest of them all. 
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detetovinternet.bg NASM AETETO 


B WVHTEPHET 
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AKTUBHATA CUYPHOCT 


detetovinternet.bg 


[6] 
990 


NA3M DETET 


B WVHTEPHET 


Stay tuned! 


1. https: //linkedin.com/in/yavorkolev 

2. https://youtu. be/KtGFByAJRQQ 

3. https://blogger .googleusercontent .com/img/a/AVvXsEjxMuK7 1REGwmj X99RgzXAy4wYdfDx42QBtrEtm_pEd5AP5TcmikOsSLc 
R_qSw50QnRcW-- j JDYH43nQXTyTAa__d5jqs4WwiX50e9cr5D70-Ky 

4. https: //blogger .googleusercontent .com/img/a/AVvXsEi45516ejzXCcBZX5vpR_D2vMudSVF 9B6uzZCBoQLz4i0zgGS91WLYMP J 
jxDOdhYxA4oXTs2hx8WHKt 5LSGQiP-aWekG5Vnf IK2D6_XbZQ1SSkp 

5. https://blogger.googleusercontent.com/img/a/AVvVXsEhA1M3s_4XBe3MrIdxRo1Y-cTQScjH7u5K_60g_K6XdGMhu_3eNsHCNo- 
QiP6dIt1lWtaBeksqJaKTYqL7Cg00IRbBRuft OndQUYI7YayBOoMs9D 

6. https: //blogger .googleusercontent .com/img/a/AVvXsEi 1avC3NL_HFtA3MvMF1VEam1SrVqZ89C7 Jyy1aQr Jc8RthKuIthkKM33 
kZG77Gr1G4wjIgkQW1s4GqM4wFbQQ1bWai j 7G8DUmrfEBiRMC1_Wio 
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1.3.6 Exposing Hacking Team GhostSec - An Analysis (2023-05-20 13:03) 


[1] 


In this post I'll profile Hacking Team GhostSec and I'll provide all the relevant and necessary 
loCs (Indicators of Compromise) including all the relevant personally identifiable information 
in terms of assisting U.S Law Enforcement and the U.S Intelligence Community on its way to 
properly track down and monitor and prosecute the cybercriminals behind these campaigns. 


Personal Photos: 


[2] 
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Related loCs and personally identifiable information for GhostSec: 
Official Web Site URL: hxxp://opiceisis.strangled.net 

Official Web Site URL: hxxp://81.4.124.11/index.php 

Official Web Site URL: hxxp://pst.klgrth.io 

Official Group’s Twitter account: hxxp://twitter.com/ghost _s3curity 
Official Group’s Telegram account: hxxp://t.me/GhostSecc 

Official Group’s Medium account: hxxp://medium.com/@OfficialGhos tSec 
Official Group’s Web Site URL: hxxp://ghostsec-team.org 

Official Group’s Web Site URL: hxxp://ghostsecret-team.blogspot.com 
Official Group’s Email Address Account: ghostsecteam.org@gmail.com 
Stay tuned! 
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1.3.7 Exposing The "Denis Gennadievich Kulkov" a.k.a 
Kreenjo/Nordex/Nordexin/Try2Check Cybercriminal Enterprise - An Analy- 
SiS (2023-05-20 13:04) 


[1] 


Who would have thought? The U.S Secret Service is currently offering $10M reward for [2]Denis 
Gennadievich Kulkov also known as Kreenjo/Nordex/Nordexin who’s particularly famous for 
running the infamous Try2Check credit card checking cybercriminal enterprise. 


What’s so special about this individual is the fact that he’s also been running a well known 
money mule recruitment operation since 2016 using the World Issuer LLC money mule re- 
cruitment franchise based on my research using public sources where we've got the actual 
hxxp://worldissuer[.]biz domain registered using identical domain registration information such 
as for instance hxxp://try2services[.]Jcm including several other domains such as for instance 
hxxp://dam-shipping[.]Jcom and hxxp://cloudnsman[.Jorg and the following domain which is 
hxxp://elementconstructiongroup[.]compan y. 


Among the actual domains known to be part of the Try2Check cybercriminals enterprise include: 
hxxp://try2services[.]pom 
hxxp://try2services[.Jcm 
hxxp://try2services[.]vc 
995 
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public-dns us 
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16cda323189d8ebas248cba2bad0déf 


including the following domain: 
hxxp://just-buyf[. Jit 


including the following two ICQ numbers 855377 and 555724 and let’s don’t forget his personal 
email address accounts obtained using public sources which are polkas@bk.ru nordexin@ya.ru 


[4] 
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and it doesn’t get any better than this as we’ve got a pretty good and informative domain port- 
folio registered by the same individual based on public information sharing the same domain 
registration details such as for instance hxxp://worldissuer[.]biz which actually are: 


@®) 
‘<) 
dam-shipping.com 
hxxp://cloud-mine[.]me 
hxxp://gpucloud[.Jorg 
hxxp://hyperhost[.]info 
hxxp://miservers[.]info 
hxxp://carterdns[.]Jcom 
hxxp://reshipping[.]us 
hxxp://keyserv[.]org 
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cloudnsman:ora worldissuer.biz iry2services cm 
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hxxp://antmining[. ]biz 


hxxp://investmentauditor[.]Jcom 


hxxp://sunnylogistics[.]us 


hxxp://try2services[.]Jcm 


hxxp://greatwallhost[.]net 


hxxp://jaqjckugrfffqa[.]com 


hxxp://numberoneforyou[.]net 


hxxp://getprofitnow|.]biz 


hxxp://avsdefender[.]com 


hxxp://spyware-defender[.]com 


hxxp://beta-dns[.]net 


hxxp://mpm-profit-method[.]com 


hxxp://public-dns[.Jus - [6]related including [7]this 


hxxp://adobe-update[.]net - Email: krownymaradonna@onionmail.org related domains known 
to have been involved in the campaign include - hxxp://amazon-clouds[.]com; hxxp://microsoft- 
clouds[.]net; hxxp://telenet-cloud[.]com; hxxp://vmware-update[.]com 


hxxp://kwitri[.]net 


hxxp://dcm-trade[.]com 


hxxp://karoospin[. ]biz 


hxxp://fastvps[.]biz 
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sunnylogistics_us 


alex@phoenixtecsupportinfo 


@ @) @) 
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cancan.us dworaktrading.us transferbucks.us 
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tiltshop_us whatsappousiness.us 


Stay tuned! 
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1.4 June 


1.4.1 The Ransomware "Epidemic" - Or How To Strike Back? (2023-06-02 11:19) 


[1] 


YOUR COMPUTER HAS BEEN LOCKED! 


This operating system Is locked due to the violation of the federal laws of 
the United States of America! (Article 1, Section 8, Clause 8; Article 202; 
Article 210 of the Criminal Code of U.S.A. provides for a deprivation of 
liberty for four to twelve years.) 

Following violations were detected: 

Your IP address was used to visit websites containing pornography, child 
pornography, zoophilia and child abuse. Your computer also contains 
video files with pornographic content, elements of violence and child 
pornography! Spam-messages with terrorist motives were also sent from 
your computer. 

This computer lock is aimed to stop your illegal activity. 


You have 72 hours to pay the fine, otherwise you will be arrested. 


You must pay the fine through 

To pay the fine, you should enter the digits resulting code, which is 
located on the back of your in the payment form and press 
OK (if you have several codes, enter them one after the other and press 


Not only did we live to see it we’re actually living and taking actions one way or another to 
see it and yes it’s the ransomware "epidemic" that I’m referring to and which I'll try to expose 
in this post by not only providing the typical for me technical details and related action and 
response initiatives that I’ve launched in the process but also provide a relevant and in-depth 
understanding of the modern concept greatly inspired by a free resources which | came across 
to on Twitter today namely - [2]Ransomchats which is outstanding and almost unbelievable 
initiative that offers an in-depth peek inside the supposedly secret chat conversations between 
ransomware "customer support" and the multi-billion dollar victim which in this case is a reality. 


Greatly inspired by the general availability of this free resource I’ve decided to dig a little 
bit deeper inside these publicly accessible of what appears to be proprietary conversations 
using a popular tool which I’m using to cluster and produce graphs of current and ongoing 
conversations between the bad guys that | come across to and provide my point of view on 
a surreal problem that’s being fought with the wrong resources and technical means to begin 
with and further elaborate and actually share the results of a sample experiment that | did on 
the topic in basically my spare time. 


Sample graphs based on the recently released communication courtesy of the Ransomchats 
project: 
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few files 120.298 
_ nto 120.157 
dectyption process 116.921 
other files 116.575 
customer data 110.368 
one file 110.127 
sample files: 106.946 
_ nist 103.425 
file names 102,157 
single file 100.973 
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million dollars 100.814 
program files 99.428 
small amount 97 083 
much money 96.027 
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decryption key 94.317 
private data 93.084 
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_ ndata 61.756 
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test decryption 49.678 
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file listing 
stolen files 

test decryptor 
net income 
test files 
company name 
_ ndiscount 

_ nfor 
decryption keys 
extra time 
bitcoin wallet 
large arnount 
financial data 
little time 
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bte wallet 

many files 
financial reports 
key file 

random files 
data leak 
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data files 51.736 
realistic amount 51.377 
universal decryptor 49.623 
general decryptor 49.077 
encryption process 45.867 
_nneed 43.767 
small price 48.323 
_ newindow 47,307 
complete list 45.570 
data tree 45.192 
final price 45.067 
blog post 44.874 
small business 44.730 
security report 44.708 
value of data 44,562 
last price 44.294 
small files 44,057 
test payment 43.505 
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proof of data 43.483 
_ n conversation 43.446 
ransom amount 43.202 
ransom price 43.008 
sample of files 42.778 
entire network 42.511 
downloaded data 41.675 
confidential files 41.590 
big files 41.461 
[5] Same amount 41.406 
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1.4.2 A Brief Overview of U.S Cyber Command’s Global Cyberspace Operations Syn- 
chronization (GCOS) Concept - Or Can We Make The Difference Between Real- 
Time and Synchronization in Cyberspace? (2023-06-02 11:21) 


[1] 


Global Cyberspace 
Operations Synchronization 


Defense Science Board 


21 February 2017 


The overall classification of this briefing is: SECREFAANOFORN 


Classified Byte 
Derived From: USCYBERCOM SCG 
AND 
Derived From: NSA/CSSM 1-52 
Onted: 20111011 
Orctassify On: 20620206 


It should be clearly said that the current state of the U.S Cyber Command’s overall Global 
Cyberspace Operations Synchronization (GCOS) Concept is fairly naive and a bit childish in 
the context of what | can best describe as real-time cyberspace operations where the primary 
difference between synchronization and real-time can be best described like Feedburner vs 
OSINT as a concept where Feedburner despite being a well known product and a service is 
basically delivering its content and features using synchronization compared to other modern 
approaches given the fact that they can be achieved such as for instance real-time cyberspace 
operations where the ultimate goal would be to achieve the unachievable namely the use of 
real-time cyberspace operations compared to marely synchronizing them to achieve something 
that | won’t really elaborate on such as for instance the surreal synchronization of U.S Cyber 
Command cyberspace operations compared to real-time cyberspace operations. 


Real-time communications have to do with pushing the very boundaries of an individual or an 
organization sticking to common good where in most of the cases the common good can get 
someone in trouble. 


I'll now proceed and give you a pretty decent of something that I’m unknowingly extremely 
good at and a process and a concept excluding the fact that it’s not a process at all in case you 
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can’t or don’t really know or bother to implement it but rather remains a bit of a commercial and 
a bit of a sophisticated practice known as military and cyberspace deception and cladestine 
and special cyber operations type of activity where the ultimate goal would be to eventually 
make people and folks laugh one way or another based on what can be truly achieved here. 


Let’s take a moment and give you a brief example on the process. Military and cyberspace 
deception and clandestine and special cyber operations activity as a concept has been around 
since the early days where | originally began preaching on the use of "People’s Information 
Warfare" by Chinese hacktivists where the ultimate goal would be to crowdsource the actual 
bandwidth for a particular campaign to the massess and actually to sometimes unaware end 
users and organizations which believe it or not takes and it better doesn’t to another direct 
namely the MakeLoveNotSpam project initiative dating back to 2004. 


"Setting the globe" based type of scenario is a bit childish explanation of what global segments 
of synchronization really means compared to real-time cyberspace operations and what should 
be really considered here is the true nature of what real time really means in the global context 
of cyberspace operations. 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEjSUJO£9£ 6KswuZPZbWYm062AbWPXzqRf0 j TEGel oRWgPHi 
r3hkHYzhc5DpDI jadZEc_eiLYAQwoPdoMcPMjBswWoxXX8hnod0ys3 


1.4.3 Assessing the Current State of Cyber and Cyber Military Deception Concepts 
Online - Part One (2023-06-02 14:30) 


[1] 
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The overall state of today’s modern cyber deception and cyber military deception online has 
to do with a maze of sophisticated and advanced asset camouflaging activities including a 
basically a state of overall cyber dominance and cyber power in the context of systematic 
professional and sophisticated control and distribution of information locally including interna- 
tionally in the context of having others not just perceive but actually do something provoked 
or prompted by a sophisticated information campaign distributed in a classified or secret way. 


The primary purpose behind coming up with this post is to shed more light into my understand- 


ing of the overall concept and to actually demonstrate and give relevant examples from the 
field. 


Misperception: 


Among the few basic concepts for starters in the field of cyber and military cyber deception 
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next to information operations has to do with misperception where the very bottom of a specific 
concept is basically twisted to the point of having others do things and make impact in the 
information camping without really perceiving the true state of the process where others will 
eventually benefit from what you’re initially prone to believe and will even greatly benefit from 
what you’re actually about to do based on the specific information operation. 


Surprise 


A closely kept secret and an information operation is everyone’s surprise at a later stage when 
the actual implementation phase or actual maturity if any phase and finally the actual launch 
of the information operation takes place leading it to become everyone’s surprise. 


Deception 


The very basics of cyber and cyber military deception has to do with a very but closely kept 
secret word and a phase where the ultimate reality is that this is a process known as on pur- 
posely or indirectly both consciously or on purpose making others think act upon or actually 
believe to a certain extend and take action basically the process known as a twisted reality. 


Deliberate misleading 


The process has to do with either attempting to trick or entice an individual or an organization 
into heading in the opposite direction or coming up with a process that can either sort of impose 
costs to its current upcoming and emerging both real life and cyber operations. 


False represenation of environment 


This is a relatively sophisticated process both in real life and in cyberspace that could ultimately 
lead to an utopian world or everyone’s dream come true reality where we could have entire 
cyber populations both malicious and not malicious act think train and even educate them- 
selves based on a wrongly perceived reality where the ultimate goal would be for someone to 
basically manage a cyber deception and cyber military deception information operation where 
the ultimate goal would be to launch and actually monitor its process throughout the decade. 


Everything that’s seen can be actually hidden 


This is a relatively advanced and sophisticated approach that entices users and organizations 
into living in the other side of the world where the ultimate goal would be to portray a situation 
or a specific information operation where the ultimate goal would be to entice people and 
organizations into taking action based on the information operation. 


Everything’s that’s ready is actually unready 


This is a similar approach that could take into consideration the timelines of events and an 
individual’s or an organization’s development cycle for a specific purpose where the ultimate 
goal would be to launch an information operation. 


1. https: //blogger .googleusercontent .com/img/a/AVvXsEgpW2-XCiLggsuhnat8_5Py4__9EUf5vsK30bGHQHikka_rthOFRfu6cB 


ef XZUzyeF6vkZSWrdcZRzDCP_uhjQ-Y3F6UakVQZMqWvrYHAVYD3p 
1015 


1.4.4 Dancho Danchev’s OSINT and Threat Intelligence Training Video Demonstra- 
tion in Bulgarian - Part Two (2023-06-04 07:12) 


[1] 


ABOUTUS ie 
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at's currently running one of 
‘Ss most popular security publications 


danchey blogspot.com since Oe tive 
S received approximately 5.8M 
page Mews sinosite original etart individuals 


OSINT AND THREAT INTELLIENCE 


- ‘ ] PROGRAM BUILDING AND TRAINING 


REACH US 


+359876893890 


Email: dancho.danchev@hush.com 


https; //ddanchev.blogspot.com 


HTTPS://DDANCHEYV, BLOGSPOT.COM 


I’ve decided to share with everyone a recently released YouTube video demonstration in Bul- 
garian on the topic of OSINT and threat intelligence training. 


Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgar- 
ian: 


Kon ce WUHTepecyBa OT WUHAuBUAyaNHO wnu rpynoBo obyYeHve B ccepata Ha OS- 
INT aHanu3 uv npeBeHunNA Ha KN6ep npecTEnneHuA U aHanuz U OOpaboTKa Ha KkuUbep 
aTaKY VWU3BeECTeH OLE KATO NMpakTUKaTa Threat Intelligence? Moxete ga sBugute 
mMoeto CV tTyk - [2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho 
_Danchev _CV _2021.pdf noptdonuo oT aHanu3u wu npoyyBaHua oT 2005 go 
2023 Tyk ~-_ [3]https://archive.org/details/@ddanchev sBugeo AeMOHCTpauMu TyK - 
[4]https://youtube.com/@ddanchev u mow xKypHan TyK - [5]https://ddanchev.blogspot.com 
HeMOHCTpalMa 3a HayyYeHOoTO Tyk - [6]https://archive.org/download/dancho-danchev-cyber- 
threat-actors-analys is-2021-2/Dancho Danchev Cyber Threat Actors Analysis _2021- 
2.pdf KaKTO U MOA MeMOap Ha Besrapcku tyk - [7]https://archive.org/download/dancho- 
danchev-kiber-razuznavane-audio-kn iga-Ol-memoar/Dancho _Danchev Kiber —_Razuz- 
navane _Memoar 02.pdf KakTo u Bugeo oT NocnegAHua Cyber Security Talks Bulgaria - 
[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga = ria-2022-video- 
presentation-01/Dancho _Danchev _Cyber Security Talks Bulgaria 2022 Video _Presen- 
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tation _01.mp4 KakTo UU BCMYKUY MON Npe3zeHTauNN Tyk - [Y]https://archive.org/details/rsa- 
europe-presentation-01 KaKTO U BCUYKM MOU NpakTUYeCKU aHAasIM3U Ha KUOep atau 3a MOA 
pa6otogaten tyk - [10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego- 
bull etproof-infrastructure-2 


NMpumepuHua kypc 3a OSINT o6yy4eHue KOUTO NpeANaraM BKJIIOUBA: 


¢ HocturaHe go WU3TOYHUKa Ha Kubep Atakata Ilo Bpeme Ha AHanu3a Ha WUHcdbopmauna c 
Ny6nnu4Hu U3stouHuun 


¢ 3non3BaHe Ha Pa3y3HaBaHe Ha WHdbopmauya c Ny6nnyHu U3TOYHUMUY B aHasIN3a Ha KNOep 
aTaku 


¢ W3n0n3BaHe Ha Pa3y3HaBaHe Ha WUHdopmaunsa c My6nuyHu U3ToOYHuuUN B 6opbaTa c 
npectTbnneHuata 


¢ Kon e DaHyo DaHnyes? 
* Kou Ca HAKON OT TeEKYLUNTE MU UV ObAeELWM NpoeKkTHU B Ccbepata? 


¢ OOoraTABaHe Ha UHGopmauuata no Bpeme Ha AHanu3a Ha Undbopmauua c MyonnyHu 
VU3TOYHULIN 


* OCHOBM Ha Pa3y3HaBaHeTO C NyOnuy4Hn U3TOYHUUNM Ha UHcbopmauna 


NpaktTuyecka JemMoHcTpauua Ha AHanu3 Ha UHcbopmauna c Ny6nuy4Hun U3sToYHuUN 


¢ MpakTuyecku Mpumepu Ha AHanu3 Ha Uncbopmauna c Ny6nuyHu U3stToyHuun 


MpakTUYecku CbBeTV NO Bpeme Ha AHasIn3a Ha UHcbopmaunya c Ny6nuyHu U3stToYHuuM 


NpegactaBaHe Ha Kypca 


¢ CbOupaHe Ha TexHnyecka WHcbopmauna no Bpeme Ha AHasu3a Ha WHcbopmauna c Ny6nuyHn 
VU3TOYHNLM 3a HanpegaHasn 


* CbO6upaHe Ha TexHnyecka UHcbopmauna no Bpeme Ha AHasu3a Ha WHcbopmauna c Ny6nuyHn 
V3TOYHNuM 3a HaynmHaeun 


¢ TakTuku vu Metogonoruu 3a HaynHaelln 
¢ TakTukKu uv Metotogonorunu 3a HanpegHann 


e TekylwOo CbCTOAHUe Ha Na3apa 3a NpoAyKTU WU ycnNyru CBbp3aHUu Cc Pa3y3HaBaHe Ha 
aVUHcbopmauna c Ny6nnyHu U3stToOYHuuNY Ha UHcbopmauna 


* OUHaNeH U3nuT vu Benpocu 

Mpumep kypc no threat intelligence KONTO npegANaraM BKsIIOUBAa: 

¢ Bop6a c KuOepnpecTBnNHOCcTTa B KOHTeKCTAa Ha U3NO/I3BaHe Ha UH*opmalvaA 3a 3annaxu 
¢ BbeLueTO Ha pa3y3HaBaHeTO Ha 3annaxu 


¢ YCbBbPLUCHCTBAaHUY NpakTUKM 3a pa3y3HaBaHe Ha 3anmaxuv KOHWeNLMUM WU MeTOgONOrUN - 
NpaktTuyecku npumep 


¢ BbBegeHune 


* Kak ga u3non3BaTe ny6nnuyHu u coOcTBeHu 6a3U DaHHUM 3a pa3y3HaBaHe Ha 3annaxu 
3a KaMnaHUN 3a NpunucBaHe Ha yYaCcTHULM B KUOepHeTMYHU 3annNaxu, BKAIOYUTeENHO 
KPpbCTOCAaHU NpenpaTkKU VU KPbCTOCaHA NpoBepKa 
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* Kak ga oOoratTute loC 3a yAnatTa Cv KomMNaHMA (VHANKaTOPUN 3a KOMNpOMeTUpaHe) C 
nomouwta Ha nyOnnyHu uv co6cTBeHVY U3TOYHVULIM U fa CBbpxKeTe TOYKUTe NpUu ronaAmMa 
Kubepataka UW KaMnaHuUA 3a AKTbOP B KUOepHeTMYHa 3annaxa 


¢ W3non3BaHe Ha OSINT B KOHTeKCTa Ha CbOupaHe Ha UH*opmawnaA 3a 3annNaxu 


¢ W3scnegBaHe Ha KYvOepnpecTbnneHnaA uU pa3y3HaBaHe Ha 3annaxu loC (WHaAuKaTOp 3a 
KOMNpomuc) OboraTABaHe B KOHTeKCTa Ha U3NON3BaHe Ha OSINT 


¢ MpaktTukata 3a 6op6a c KuOepnpecTEnneHuATa 4pe3 pa3sy3HaBaHe Ha 3annaxu 

* KOHUeNLINY 3a pa3y3HaBaHe Ha 3amnaxu 3a HAYWHaeLU 

* MetTofonorun 3a NpoaKTUBHO pa3y3HaBaHe Ha 3anmnaxu 

* MeTogonoruu 3a pa3y3HaBaHe Ha 3annaxu 

* OOoraTABaHe Ha UH*opmalivaA 3a 3amsaxU B KOHTeKCTAa Ha U3NON3BaHe Ha OSINT 


* Kak da NpeBbpHeTe BaLUUTe KNVUeCHTM B NACVBHUY VU aKTUBHY pa3snpegeneHu CeH30pV 3a 
CbOupaHe Ha UVH*opMaulvA 3a 3anNaxu? 


¢ OCHOBU Ha Ppa3yY3HaBaHeTO Ha 3ansaxu 


° Pa3LUNPeHO PYHKLIMOHMpaHe VU NOAAbPxKaHe Ha Nporpama 3a pa3y3HaBaHe Ha 3amsaxu B 
luanatTa KOMNAHNMA 3a HanpesAHanu notTpebutennu 


¢ MpakTUyeckn CbBeETU 3a pa3y3HaBaHe Ha 3amsaxu 
* OCHOBUTe Ha 3€NOYBAHETO Ha pa3y3HaBaHe Ha 3anNaxu 3a HAYMHAeLN 
¢ Pa3y3HaBaHe Ha 3amlaxu B KOHTeKCTa Ha KUbepataka. 


- Pa3y3HaBaHe Ha 3alnslIaxXUTe B KOHTCKCTaA Ha U3NOJISBAHE Ha TEXHUYECKO CcbOupaHe 3a aTaKU 
C NPUNUCBAHE Ha AKTbOP Ha KUOepHeTU4Ha 3anslaxa 


¢ Pa3LUNPeHU KOHLIENLIMM 3a pa3y3HaBaHe Ha 3anNaxu 


* Kak ga npeoOpa3yBate KpaWHuTe TOYKUY Ha cnyKuUTenUTe Ha BalwaTa KOMNAHUA B 
pa3npegeneH CeH30p 3a CbOuUpaHe Ha UHopmMauWA 3a NACUBHU VU AKTUBHU pa3y3HaBaHUAr 
3a 3annaxu? 


¢ TeKyLUO CbCTOAHME Ha EKOCUCTeMaTa 3a pa3y3HaBaHe Ha 3ansaxu 
¢ TeKYLUO CbCTOAHME Ha Na3apa 3a pa3y3HaBaHe Ha 3annaxn 


¢ HavuctuHa mu pabotu metofonorusta ,ArperupaHe vu 3a6paBAHe” B OONacTTa Ha 
pa3y3HaBaHeTO Ha 3annaxu? 


° OCHOBMTe Ha CTapTUpaHeToO, NOAAbPXKaHeETO UV yNpaBsIeHUeTO Ha Nporpama 3a pa3y3HaBaHe 
Ha 3anaxu B UAsaTa KOMNaHMA 3a HaYNHaellin 


« Kak da o6yuute BaLUUTe AHAJIUZATOPU 3a Pa3Y3HABAHE Ha 3alMlaxu fla Obaat poK 3Be34uU 
Ha UHAYCTPUATA 3a CUFYPHOCT U AHANIUTUYHUTE VU TEXHUYECKU POK 3Be3 qu? 


Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in 
Bulgarian: 
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Dancho Danchey 

Independent Contractor 
httesi//iddanchey.blogspot.cam 
Email: dancho.danchev@hush.com 
#35987 6893890 


In case you're interested in inquiring about individual or group OSINT or threat intelligence 
training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVvXsEjdqHf JrWMLhCgApsiWsoIL2ocIRKCxDHOq7L5vaDxqldcia 
vbn9Ksyg33rVQQnxRM1kPnpfePn08kBOuJFFtc8It3Hjcgu7mHzKH 


9. https://archive.org/details/rsa-europe-presentation-01 


10. https: //archive. org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2 
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1.4.5 Dancho Danchev’s OSINT and Threat Intelligence Training Video Demonstra- 
tion in Bulgarian - Part One (2023-06-04 07:12) 


ABOUTUS ie 
Dancho Danchev Presents 


Danche Danchev is an internationally recognized 
cybercrime researcher security blogger OSINT analyst and 
threat intelligence analyst that's currently running one of 
the sacurity industry's most popular security publications 


his personal blog - https, //ddancheyv blogspot.com since er. 
December, 2005 which has received approximately 56M 
page views since its original start In viduals 


OSINT AND THREAT INTELLIENCE 


: \ ] PROGRAM BUILDING AND TRAINING 
REACHUS Si e 
+359876893890 ¢ 
Email: dancho.danchev@hush.com : 
https; //ddanchev.blogspot.com 3 


HTTPS 


I’ve decided to share with everyone a recently released YouTube video demonstration in 
Bulgarian on the topic of OSINT and threat intelligence training. 


Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in 
Bulgarian: 


Kon ce UHTepecyBa OT VHAUBUAYyAaNHO usin FpynoBo Obyy4eHve B Cdbepata Ha OSINT aHannu3 u 
npeBeHuUMA Ha KNUOep NpecTEnneHuaA VU aHanu3 U OOpaboTtka Ha Kubep aTaku U3BeECTEH OLE 
KaTO npakTuKaTa Threat Intelligence? MoxeTe ga BuguTe MoeTO CV Tyk - 
[1]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho Danchev _CV 
_2021.pdf noptcdonuo oT aHanu3u uv npoyyBaHua oT 2005 fo 2023 Tyk - 
[2]https://archive.org/details/@ddanchev Bugeo QEMOHCTpauWy TyK - 
[3]https://youtube.com/@ddanchev u moa KypHan TykK - [4]https://ddanchev.blogspot.com 
AeMOHCTpPAalNA 3a HAYYEHOTO TYK - 
[5]https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis 
-2021-2/Dancho Danchev Cyber Threat Actors Analysis _2021-2.pdf kKakTo u Mo” MeMoap 
Ha Bbsirapcku TykK - 
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[6]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-knig 
a-01-memoar/Dancho Danchev _Kiber Razuznavane Memoar 02.pdf kakTo u Bugveo OT 
nocneguHua Cyber Security Talks Bulgaria - 
[7]https://archive.org/download/dancho-danchev-cyber-security-talks-bulgari 
a-2022-video-presentation-01/Dancho Danchev Cyber Security Talks Bulgaria 2022 
_Video Presentation 01.mp4 KakTOo uv BCUYKU MOU Npe3ZeHTALMN TyK - 
[8]https://archive.org/details/rsa-europe-presentation-01 KakTo uw BCMYKUM MoU NpakTUYeCKU 
aHanu3u Ha KU6ep atau 3a MOA paboTosaTen TyK - 
[9]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletp 
roof-infrastructure-2 


NpumepuHua kypc 3a OSINT o6yy4eHue KOUTO NpeANaraM BKJIOUBa: 


¢ HocturaHe go WU3sTOYHUKa Ha Kubep Atakata Ilo Bpeme Ha AHanu3a Ha WHcdbopmauna c 
Ny6nnu4Hu U3stouHuun 


¢ U3non3BaHe Ha Pa3y3HaBaHe Ha WHcbopmauya c Ny6nnyHu U3TOYHUMUY B aHasIu3a Ha KNOep 
aTaku 


¢ W3n0n3BaHe Ha Pa3y3HaBaHe Ha WUHdopmaunsa c My6nuyHu U3ToYHuuN B BopbaTa c 
npecTpnneHuata 


¢ Kon e DaHyo Danyes? 
* Kou Ca HAKON OT TeEKYLUNTE MU UV ObAeELIM NpoeKTU B Ccbepata? 


¢ OOoraTABaHe Ha UHGopmauuata no Bpeme Ha AHanu3za Ha UHdbopmauua c NyonnyHu 
VU3TOYHULIN 


* OCHOBN Ha Pa3y3HaBaHeTO C NyO6nuy4Hn U3ZTOYHUUN Ha UHcbopmauna 

¢ MpakTuyecka JemMoHctpauna Ha AHanu3 Ha Unqbopmaunva c Ny6nuyHu U3tTouHuun 

¢ MpakTuyecku Mpumepu Ha AHanu3 Ha Uncbopmauna c Ny6nuyHu U3tTouHuun 

¢ MpakTuyecKu CbBeTU NO Bpeme Ha AHasu3a Ha WHqdbopmauna c Ny6nuyHu U3sToYHuuN 
¢ MpegactaBaAHe Ha Kypca 


* CbO6upaHe Ha TexHunyecka UHcbopmauna no Bpeme Ha AHasiu3a Ha WHcbopmauna c Ny6nuyHn 
VU3TOUHNLM 3a HanpegaHann 


* CbOupaHe Ha TexHnyecka WHcbopmauna no Bpeme Ha AHasu3a Ha WHcbopmauna c Ny6nuyHn 
VU3TOYHNuW 3a HaywHaeuin 


¢ TakTuku uv Metogonoruu 3a HaynHaelln 
¢ TakTuKu uv Metotogonoruu 3a HanpegaHann 


e TekyluO CbCTOAHMUe Ha Na3apa 3a NpoAyKTU UW ycnyru CBbp3aHUN Cc Pa3y3HaBaHe Ha 
aVUHcbopmauna c Ny6nnyHu U3stToOYHuuUY Ha UHcbopmauua 


¢ OvHaNneH WU3snuTt vu Benpocu 

Mpumep kypc no threat intelligence KONTO npeANaraM BKsIIOUBAa: 

¢ Bop6a c KuObepnpecTBnHOcTTa B KOHTeEKCTAa Ha U3NO/I3BaHe Ha UH*opmauvA 3a 3annaxu 
¢ BbeLeTO Ha pa3y3HaBaHeTO Ha 3annaxu 


¢ YCbBbPLUCHCTBAaHUY NpakTUKM 3a pa3y3HaBaHe Ha 3ansaxuv KOHWeNLMUY WU MeTOgONOrUN - 
NpaktTuyecku npumep 
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¢ BbBegeHne 


* Kak ga u3non3Bate ny6nnuyHu uv coOcTBeHu 6a3N DaHHUY 3a pa3y3HaBaHe Ha 3annNaxu 
3a KaMnNaHuW 3a NpwvnucBaHe Ha yYaCTHULM B KUOepHeTMYHU 3anNaxu, BKIOYUTENHO 
KPbCTOCAaHU NpenparTKyU VU KpbCTOCaHAa NpoBepKa 


* Kak ga oOoratute loC 3a UAnaTa Cv KoMNaHMA (VHAUKaTOPU 3a KOMNpOMeTUpaHe) C 
nNOomMOuTa Ha nyOnnyHu uv cOo6cTBeHY U3TOYHULM UYU ga CBbpxKeTe TOYKUTe NpUu ronaAmMa 
Kubepataka UW KaMnaHuUA 3a AKTbOP B KUOepHeTMYHa 3annaxa 


¢ U3non3BaHe Ha OSINT B KOHTeKCTa Ha CbOupaHe Ha UH*opmaunaA 3a 3annaxu 


¢ W3scnegBaHe Ha KYvOepnpectTbnneHnA U pa3y3HaBaHe Ha 3annaxu loC (WuHAUKaTOp 3a 
KOMNpomuc) OboraTABaHe B KOHTeKCTa Ha U3NO3BaHe Ha OSINT 


* MpaktTukata 3a 6opba c KubepnpecTEnneHuATa 4Ype3 pa3sy3HaBaHe Ha 3annaxu 

* KOHLIENLIMM 3a pa3sy3HaBaHe Ha 3annaxn 3a HAYNHAeLU 

¢ MeTogonorun 3a NpOaKTMBHO pa3y3HaBaHe Ha 3anmsaxu 

* MetTogonorun 3a pa3y3HaBaHe Ha 3annaxu 

* O6oraTaABaHe Ha UH*opmMalinaA 3a 3annaxv B KOHTeKCTa Ha U3NO3BaHe Ha OSINT 


* Kak da NpeBbpHeTe BaLUUTe KNNeCHTM B NACVBHY VU aKTUBHY pa3snpegeneHu CeH30pU 3a 
CbOupaHe Ha UHopMauvA 3a 3annaxu? 


* OCHOBU Ha Ppa3yY3HaBaHeTO Ha 3alNsaxu 


° Pa3LUNPeHO PYHKLMOHMpaHe VU NOAAbP»xKaHe Ha Nporpama 3a pa3y3HaBaHe Ha 3ansaXxu B 
luanatTa KOMNAHNMA 3a HanpesAHanu noTpebutennu 


¢ MpakTUyeckn CbBeETU 3a pa3y3HaBaHe Ha 3amsaxu 
* OCHOBUTe Ha 3€NOYBaHETO Ha pa3y3HaBaHe Ha 3anNaxu 3a HAYNHAeLI 
¢ Pa3y3HaBaHe Ha 3amlaxu B KOHTeKCTa Ha KUbepataka. 


© Pa3y3HaBaHe Ha 3alNsIaXUTe B KOHTCKCTA Ha U3NOJISBAHE Ha TEXHNYECKO CcbOupaHe 3a aTaKU 
C NPUNUCBAHE Ha AKTbOP Ha KUOepHeTUuHa 3anslaxa 


¢ Pa3LUNPeHU KOHLIENLIMM 3a pa3y3HaBaHe Ha 3anNaxu 


* Kak ga npeoOpa3yBaTte KpaWHuTe TOYKUY Ha cnyxKuTenuTe Ha BalwaTa KOMNAHUA B 
pa3npegeneH CeH30p 3a CbOupaHe Ha UH*opmMauWA 3a NACUBHU VU AKTUBHU pa3y3HaBaHUA 
3a 3annaxu? 


¢ TeKYLUO CbCTOAHME Ha CKOCUCTeEMaTa 3a pa3y3HaBaHe Ha 3ansaxu 
¢ TeKYLUO CbCTOAHME Ha Na3apa 3a pa3y3HaBaHe Ha 3annaxn 


¢ HavctuHa mu pabotu metogonorusta ,ArperupaHe u 3a6paBAHe” B OOnacTTa Ha 
pa3y3HaBaHeTO Ha 3annaxu? 


* OCHOBUITe Ha CTapTUpaHeTO, NOAAbPMKAHETO VU YNPABJIEHUETO Ha NpOrpaMa 3a Ppa3y3HaABAaHEe 
Ha 3anvlaxu B LANATA KOMNAHUNA 3a HAYWHAeCLLIN 


« Kak fa o6yuute BaLUUTe AHAJIUZATOPU 3a Pa3Y3HABAHE Ha 3alMslaxu fla Obgaat poK 3Be3QuU 
Ha UHAYCTPUATA 3a CUFYPHOCT U AHANUTUYHUTE VU TEXHUYECKU POK 3Be3 qu? 


Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in 
Bulgarian: 
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Dancho Danchey 

independent Contractor 
https-iddanchay. blogspot.com 
Email: dancho.danchey@hush.com 
+359876893880 


In case you’re interested in inquiring about individual or group OSINT or threat intelligence 
training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 


ttps://disruptive-individuals.com/wp- content /uploads/2021/11/Dancho_Danchev_CV_2021. pdf 


. https://archive.org/details/@ddanche 
. https://youtube.com/@ddanche 
. https: //ddanchev. blogspot .com/ 


ttps://archive. org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Th 


eat_Actors_Analysis_2021-2.pdf 


6. ttps://archive. org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kibe 


Razuznavane_Memoar_02.pdf 


7. ttps://archive. org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Da 
ho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre 
8. https://archive.org/details/rsa-europe-presentation-01 


9. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2 


1.4.6 Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgar- 
ian - Part Three (2023-06-05 01:11) 


[1] 
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ABOUTUS ie 
Dancho Danchev Presents 


Danche Danchev is an internationally recognized 
cybercrime researcher security blogger OSINT analyst and 
threat intalligence analyst that's currently running one of 


"his personal blog Nites / ddanahe blogspot com anos hee tive 
mia eae dlloalbncesies ate 1 individual 
BASIC AND ADVANCED 
OSINT AND THREAT INTELLIENCE 
: \ 1 PROGRAM BUILDING AND TRAINING 


REACH US 


+359876893890 


Email: dancho.danchev@hush.com 


https; //ddanchev.blogspot.com 


HTTPS://DDANCHEV BLOGSPOT.COM 


I’ve decided to share with everyone a recently released YouTube video demonstration in Bul- 
garian on the topic of OSINT and threat intelligence training. 


Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgar- 
ian: 


Kon ce UHTepecyBa OT VHAUBUAYyAaNHO WN rpynoBo Oby4eHve B Ccbepata Ha OSINT aHanu3 u 
npeBeHuUNA Ha KNUOep nNpecTEnneHuva VU aHanu3 U OOpaboTka Ha Kubep aTaKuV U3BeECTEH OLE 
KaTO npakTuKaTa Threat Intelligence? MoxeTte ga BuguTe MoeTO CV Tyk - 
[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho Danchev _CV 
_2021.pdf noptcdonvo oT aHanu3u vu npoyyBaHua OT 2005 fo 2023 Tyk - 
[3]https://archive.org/details/@ddanchev Bugeo QEMOHCTpalWN TyK - 
[4]https://youtube.com/@ddanchev u Moa KypHa TykK - [5]https://ddanchev.blogspot.com 
TeMOHCTpPAaLNA 3a HAYYEHOTO TYK - 
[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys 
is-2021-2/Dancho Danchev Cyber Threat Actors Analysis 2021-2.pdf kakTo u Moa 
MeMOap Ha Bbsirapcku TykK - 
[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn 
iga-O1-memoar/Dancho Danchev _Kiber Razuznavane Memoar _02.pdf KakTo u Bugeo OT 
nocnegHua Cyber Security Talks Bulgaria - 
[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga 
ria-2022-video-presentation-01/Dancho Danchev Cyber Security Talks Bulgaria 2022 
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_Video Presentation 01.mp4 KakTo uv BCUYKU MON Npe3ZeHTALMN TyK - 
[9]https://archive.org/details/rsa-europe-presentation-01 KakTo uw BCMYKUM MoU NpakTUYeCKU 
aHasIu3u Ha KUbep atau 3a MOA paboTOAAaTeN Tyk - 
[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull 
etproof-infrastructure-2 


NMpumepuHua kypc 3a OSINT o6yy4eHue KONTO NpeANaraM BKJIOUBA: 


¢ HocturaHe go WU3sTOYHUKa Ha Kubep Atakata Ilo Bpeme Ha AHanu3a Ha WHcbopmauna c 
Ny6nnuy4Hu U3stouHuun 


¢ W3non3BaHe Ha Pa3y3HaBaHe Ha WHcsbopmauna c Ny6nuyHu U3TOYHMUY B aHasu3a Ha Kubep 
aTaku 


¢ W3n0n3BaHe Ha Pa3y3HaBaHe Ha WUHdopmaunsa c My6nuyHu U3ToYHuuN B 6bopbaTta c 
npecTpnneHuata 


¢ Kon e DaHyo DaHyes? 
* Kou Ca HAKON OT TeEKYLUUTE MU UV ObAeELWM NpoeKTH B Ccbepata? 


¢ OOoraTABaHe Ha UHGopmauvata no Bpeme Ha AHanu3a Ha Undbopmauua c My6nnyHu 
VU3TOYHULIN 


OCHOBU Ha Pa3y3HaBaHeTo C My6nnuy4Hu U3TOYHNUM Ha WVHcbopmauna 


¢ MpakTuyecka JemMoHctpauna Ha AHanu3 Ha Unqdbopmaunva c Ny6nuyHu U3TouHuun 


Npaktuyecku Npumepu Ha AHanv3 Ha WHcdbopmauna c My6nuyHu U3ToOYHUL 


MpakTuyecku CbBeTV NO Bpeme Ha AHasiu3a Ha Unqbopmauiva c My6nuyHu U3ToXHuun 


¢ MpegctaBaAHe Ha Kypca 


CbOupane Ha TexHnyecka Uncbopmauina no Bpeme Ha AHasin3a Ha UWcbopmaunva c Ny6nny4Hu 
VU3TOYHNLM 3a HanpegaHann 


¢ CbOupaHe Ha TexHunyecka WHcbopmauna no Bpeme Ha AHasiu3a Ha WHcbopmauna c Ny6nuyHn 
VU3TouHNuM 3a HaywHaeun 


¢ TakTuku vu Metogonoruu 3a HayHaeln 
¢ TakTuKu vu Metotogonoruu 3a HanpegaHasn 


¢ TekylwO CbCTOAHUe Ha Na3apa 3a NpoAyKTU UW ycnyru CBbp3aHUu Cc Pa3y3HaBaHe Ha 
aVUHcbopmauna c Ny6nnyHu U3stToYHuuY Ha UHcbopmauna 


¢ OvHaneH U3nuTt vu Benpocu 

Mpumep kypc no threat intelligence KONTO npeANaraM BKsIIOUBAa: 

¢ Bop6a c KuOepnpecTBnHOcTTa B KOHTeKCTAa Ha U3NOsJI3BaHe Ha UHCopmauvA 3a 3annaxu 
¢ BbeLeTO Ha pa3y3HaBaHeTO Ha 3annaxu 


¢ YCbBbPLUCHCTBAaHUY NpakTUKM 3a pa3y3HaBaHe Ha 3anmsaxu KOHWeNLMY WU MeTOgONOrUN - 
NpaktTuyecku npumep 


¢ BbBegeHne 


* Kak ga u3non3Bate ny6nuyHu uv coOcTBeHu 6a3U DaHHUM 3a pa3y3HaBaHe Ha 3annaxu 
3a KaMnaHUuN 3a NpwunucBaHe Ha yYaCTHULM B KUOepHeTMYHU 3annNaxu, BKIOYUTeENHO 
KPpbCTOCAaHU NpenpatTkKU VU KPbCTOCaHA NpoBepKa 
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* Kak ga oOoratTute loC 3a yAnatTa Cv KomMNaHMA (VHANKaTOPUN 3a KOMNpOMeTUpaHe) C 
nomouwtTa Ha nyOnnyHu uv cO6cTBeHVY U3TOYHULIY UYU fa CBbpxKeTe TOYKUTe NpUY ronaAmMa 
Kubepataka UW KamMnaHuUA 3a AKTbOP B KUOepHeTUYHa 3annaxa 


¢ W3non3BaHe Ha OSINT B KOHTeKCTa Ha CbOupaHe Ha UHCopmawnaA 3a 3anNaxu 


¢ W3scnenBaHe Ha KYvOepnpecTbnneHnA UU pa3y3HaBaHe Ha 3annaxu loC (WUHAUKaTOp 3a 
KOmMNpomuc) Ob6oraTABaHe B KOHTeKCTa Ha U3NO/3BaHe Ha OSINT 


¢ MpakTukata 3a 6opba c KubepnpecTEnneHuaTa 4pe3 pa3y3HaBaHe Ha 3anNaxu 

° KOHLENLNN 3a Ppa3y3HaBaHe Ha 3ansNaxu 3a HAaYMHaeLV 

¢ MeTOgZoNOrMuu 3a NPOAKTUBHO pa3y3HaBaHe Ha 3ansNaxu 

* MeTogonorun 3a pa3y3HaBaHe Ha 3annaxu 

* O6oraTABaHe Ha UH*opmMauNA 3a 3aNnNaXV B KOHTEKCTA Ha U3NON3BaHe Ha OSINT 


* Kak da NpeBbpHeTe BaLUUTe KNNeCHTM B NACVBHY VU aKTUBHY pa3snpegeneHu CeH30pV 3a 
CbOupaHe Ha UHopmauivaA 3a 3annaxu? 


* OCHOBU Ha Ppa3Y3HaBaHeTO Ha 3alNsaxu 


° Pa3LUNPeHO PYHKLIMOHMpaHe VU NOAAbP»KaHe Ha Nporpama 3a pa3y3HaBaHe Ha 3ansaXxu B 
luanatTa KOMNAHNMA 3a HanpesAHanu noTpebuTenn 


¢ MpakTUyecku CbBeETU 3a pa3y3HaBaHe Ha 3amsaxu 
* OCHOBUTe Ha 3a€NOYBaHeTO Ha pa3y3HaBaHe Ha 3anNaxu 3a HAYNHAeLUN 
¢ Pa3y3HaBaHe Ha 3amlaxu B KOHTeKCTa Ha KUbepataka. 


ba Pa3y3HaBaHe Ha 3alnslaxXuUTe B KOHTCKCTaA Ha U3NOJISBAHE Ha TEXHUYECKO CbOupaHe 3a aTaKU 
C NPUNUCBAHE Ha AKTbOP Ha KUOepHeTU4Ha 3anslaxa 


° Pa3LUNPeHU KOHLIENLIWM 3a pa3sy3HaBaHe Ha 3amaxn 


¢ Kak ga npeoOpa3yBate KpaWHuTe TOYKUY Ha cnyxKuTenuTe Ha BalwaTa KOMNAHUA B 
pa3npegeneH CeH30p 3a CbOuUpaHe Ha UH*opMauWA 3a NACUBHU VU AKTUBHU pa3y3HaBaHuA 
3a 3annaxu? 


¢ TeKYLUO CbCTOAHMe Ha CKOCUCTeEMaTa 3a pa3y3HaBaHe Ha 3ansNaxu 
¢ TeKYLUO CbCTOAHME Ha Na3apa 3a pa3y3HaBaHe Ha 3annaxn 


¢ HavctuHa mu pabotu metofonorusta ,ArperupaHe vu 3a6paBAHe” B OOnacTTa Ha 
pa3y3HaBaHeTO Ha 3annaxu? 


° OCHOBMTe Ha CTapTUpaHeToO, NOAAbPXKaHeTO UV yNpaBsIEHUeTO Ha Nporpama 3a pa3y3HaBaHe 
Ha 3ansaxuv B UAsaTa KOMNaHMA 3a HAYNHaeLlin 


« Kak da o6yyute BaALUUTe AHAJIUZATOPU 3a Pa3Y3HABAHE Ha 3alMjlaxu fla ObaaTt poK 3Be3Qu 
Ha UHAYCTPUATA 3a CUFYPHOCT U AHANUTUYHUTE VU TEXHUYECKU POK 3Be3 qu? 


Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in 
Bulgarian: 
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(i) WANTED 


</ BY THE FBI 


MOHSIN RAZA 


22k 


In case you're interested in inquiring about individual or group OSINT or threat intelligence 
training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 


1. 
. https: fas seuptaye individuals. com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021. pdf 

Scorer 

4, Retpe: 7 geicaoe cee etammeaal 

5 

6. 


. https://ddanchev. blogspot .com/ 


ttps://archive. org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Th: 


eat_Actors_Analysis_2021-2.pdf 


ttps://archive. org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kibe 


Razuznavane_Memoar_02.pdf 


ttps://archive. org/download/dancho-danchev-cyber-security-talks—bulgaria-2022-video-presentation-01/Da 


Soe RT eee AT eR RICRTE SESS 
9. https://archive.org/details/rsa-europe-presentation-01 


ttps://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2 


1.4.7. Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgar- 
ian - Part Two (2023-06-05 01:11) 


[1] 
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ABOUTUS ie 
Dancho Danchev Presents 


Danche Danchev is an internationally recognized 
cybercrime researcher security blogger OSINT analyst and 
threat intalligence analyst that's currently running one of 


"his personal blog Nites / ddanahe blogspot com anos hee tive 
mia eae dlloalbncesies ate 1 individual 
BASIC AND ADVANCED 
OSINT AND THREAT INTELLIENCE 
: \ 1 PROGRAM BUILDING AND TRAINING 


REACH US 


+359876893890 


Email: dancho.danchev@hush.com 


https; //ddanchev.blogspot.com 


HTTPS://DDANCHEV BLOGSPOT.COM 


I’ve decided to share with everyone a recently released YouTube video demonstration in Bul- 
garian on the topic of OSINT and threat intelligence training. 


Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgar- 
ian: 


Kon ce UHTepecyBa OT VHAUBUAYyAaNHO WN rpynoBo Oby4eHve B Ccbepata Ha OSINT aHanu3 u 
npeBeHuUNA Ha KNUOep nNpecTEnneHuva VU aHanu3 U OOpaboTka Ha Kubep aTaKuV U3BeECTEH OLE 
KaTO npakTuKaTa Threat Intelligence? MoxeTte ga BuguTe MoeTO CV Tyk - 
[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho Danchev _CV 
_2021.pdf noptcdonvo oT aHanu3u vu npoyyBaHua OT 2005 fo 2023 Tyk - 
[3]https://archive.org/details/@ddanchev Bugeo QEMOHCTpalWN TyK - 
[4]https://youtube.com/@ddanchev u Moa KypHa TykK - [5]https://ddanchev.blogspot.com 
TeMOHCTpPAaLNA 3a HAYYEHOTO TYK - 
[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys 
is-2021-2/Dancho Danchev Cyber Threat Actors Analysis 2021-2.pdf kakTo u Moa 
MeMOap Ha Bbsirapcku TykK - 
[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn 
iga-O1-memoar/Dancho Danchev _Kiber Razuznavane Memoar _02.pdf KakTo u Bugeo OT 
nocnegHua Cyber Security Talks Bulgaria - 
[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga 
ria-2022-video-presentation-01/Dancho Danchev Cyber Security Talks Bulgaria 2022 
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_Video Presentation 01.mp4 KakTo uv BCUYKU MON Npe3ZeHTALMN TyK - 
[9]https://archive.org/details/rsa-europe-presentation-01 KakTo uw BCMYKUM MoU NpakTUYeCKU 
aHasIu3u Ha KUbep atau 3a MOA paboTOAAaTeN Tyk - 
[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull 
etproof-infrastructure-2 


NMpumepuHua kypc 3a OSINT o6yy4eHue KONTO NpeANaraM BKJIOUBA: 


¢ HocturaHe go WU3sTOYHUKa Ha Kubep Atakata Ilo Bpeme Ha AHanu3a Ha WHcbopmauna c 
Ny6nnuy4Hu U3stouHuun 


¢ W3non3BaHe Ha Pa3y3HaBaHe Ha WHcsbopmauna c Ny6nuyHu U3TOYHMUY B aHasu3a Ha Kubep 
aTaku 


¢ W3n0n3BaHe Ha Pa3y3HaBaHe Ha WUHdopmaunsa c My6nuyHu U3ToYHuuN B 6bopbaTta c 
npecTpnneHuata 


¢ Kon e DaHyo DaHyes? 
* Kou Ca HAKON OT TeEKYLUUTE MU UV ObAeELWM NpoeKTH B Ccbepata? 


¢ OOoraTABaHe Ha UHGopmauvata no Bpeme Ha AHanu3a Ha Undbopmauua c My6nnyHu 
VU3TOYHULIN 


OCHOBU Ha Pa3y3HaBaHeTo C My6nnuy4Hu U3TOYHNUM Ha WVHcbopmauna 


¢ MpakTuyecka JemMoHctpauna Ha AHanu3 Ha Unqdbopmaunva c Ny6nuyHu U3TouHuun 


Npaktuyecku Npumepu Ha AHanv3 Ha WHcdbopmauna c My6nuyHu U3ToOYHUL 


MpakTuyecku CbBeTV NO Bpeme Ha AHasiu3a Ha Unqbopmauiva c My6nuyHu U3ToXHuun 


¢ MpegctaBaAHe Ha Kypca 


CbOupane Ha TexHnyecka Uncbopmauina no Bpeme Ha AHasin3a Ha UWcbopmaunva c Ny6nny4Hu 
VU3TOYHNLM 3a HanpegaHann 


¢ CbOupaHe Ha TexHunyecka WHcbopmauna no Bpeme Ha AHasiu3a Ha WHcbopmauna c Ny6nuyHn 
VU3TouHNuM 3a HaywHaeun 


¢ TakTuku vu Metogonoruu 3a HayHaeln 
¢ TakTuKu vu Metotogonoruu 3a HanpegaHasn 


¢ TekylwO CbCTOAHUe Ha Na3apa 3a NpoAyKTU UW ycnyru CBbp3aHUu Cc Pa3y3HaBaHe Ha 
aVUHcbopmauna c Ny6nnyHu U3stToYHuuY Ha UHcbopmauna 


¢ OvHaneH U3nuTt vu Benpocu 

Mpumep kypc no threat intelligence KONTO npeANaraM BKsIIOUBAa: 

¢ Bop6a c KuOepnpecTBnHOcTTa B KOHTeKCTAa Ha U3NOsJI3BaHe Ha UHCopmauvA 3a 3annaxu 
¢ BbeLeTO Ha pa3y3HaBaHeTO Ha 3annaxu 


¢ YCbBbPLUCHCTBAaHUY NpakTUKM 3a pa3y3HaBaHe Ha 3anmsaxu KOHWeNLMY WU MeTOgONOrUN - 
NpaktTuyecku npumep 


¢ BbBegeHne 


* Kak ga u3non3Bate ny6nuyHu uv coOcTBeHu 6a3U DaHHUM 3a pa3y3HaBaHe Ha 3annaxu 
3a KaMnaHUuN 3a NpwunucBaHe Ha yYaCTHULM B KUOepHeTMYHU 3annNaxu, BKIOYUTeENHO 
KPpbCTOCAaHU NpenpatTkKU VU KPbCTOCaHA NpoBepKa 
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* Kak ga oOoratTute loC 3a yAnatTa Cv KomMNaHMA (VHANKaTOPUN 3a KOMNpOMeTUpaHe) C 
nomouwtTa Ha nyOnnyHu uv cO6cTBeHVY U3TOYHULIY UYU fa CBbpxKeTe TOYKUTe NpUY ronaAmMa 
Kubepataka UW KamMnaHuUA 3a AKTbOP B KUOepHeTUYHa 3annaxa 


¢ W3non3BaHe Ha OSINT B KOHTeKCTa Ha CbOupaHe Ha UHCopmawnaA 3a 3anNaxu 


¢ W3scnenBaHe Ha KYvOepnpecTbnneHnA UU pa3y3HaBaHe Ha 3annaxu loC (WUHAUKaTOp 3a 
KOmMNpomuc) Ob6oraTABaHe B KOHTeKCTa Ha U3NO/3BaHe Ha OSINT 


¢ MpakTukata 3a 6opba c KubepnpecTEnneHuaTa 4pe3 pa3y3HaBaHe Ha 3anNaxu 

° KOHLENLNN 3a Ppa3y3HaBaHe Ha 3ansNaxu 3a HAaYMHaeLV 

¢ MeTOgZoNOrMuu 3a NPOAKTUBHO pa3y3HaBaHe Ha 3ansNaxu 

* MeTogonorun 3a pa3y3HaBaHe Ha 3annaxu 

* O6oraTABaHe Ha UH*opmMauNA 3a 3aNnNaXV B KOHTEKCTA Ha U3NON3BaHe Ha OSINT 


* Kak da NpeBbpHeTe BaLUUTe KNNeCHTM B NACVBHY VU aKTUBHY pa3snpegeneHu CeH30pV 3a 
CbOupaHe Ha UHopmauivaA 3a 3annaxu? 


* OCHOBU Ha Ppa3Y3HaBaHeTO Ha 3alNsaxu 


° Pa3LUNPeHO PYHKLIMOHMpaHe VU NOAAbP»KaHe Ha Nporpama 3a pa3y3HaBaHe Ha 3ansaXxu B 
luanatTa KOMNAHNMA 3a HanpesAHanu noTpebuTenn 


¢ MpakTUyecku CbBeETU 3a pa3y3HaBaHe Ha 3amsaxu 
* OCHOBUTe Ha 3a€NOYBaHeTO Ha pa3y3HaBaHe Ha 3anNaxu 3a HAYNHAeLUN 
¢ Pa3y3HaBaHe Ha 3amlaxu B KOHTeKCTa Ha KUbepataka. 


ba Pa3y3HaBaHe Ha 3alnslaxXuUTe B KOHTCKCTaA Ha U3NOJISBAHE Ha TEXHUYECKO CbOupaHe 3a aTaKU 
C NPUNUCBAHE Ha AKTbOP Ha KUOepHeTU4Ha 3anslaxa 


° Pa3LUNPeHU KOHLIENLIWM 3a pa3sy3HaBaHe Ha 3amaxn 


¢ Kak ga npeoOpa3yBate KpaWHuTe TOYKUY Ha cnyxKuTenuTe Ha BalwaTa KOMNAHUA B 
pa3npegeneH CeH30p 3a CbOuUpaHe Ha UH*opMauWA 3a NACUBHU VU AKTUBHU pa3y3HaBaHuA 
3a 3annaxu? 


¢ TeKYLUO CbCTOAHMe Ha CKOCUCTeEMaTa 3a pa3y3HaBaHe Ha 3ansNaxu 
¢ TeKYLUO CbCTOAHME Ha Na3apa 3a pa3y3HaBaHe Ha 3annaxn 


¢ HavctuHa mu pabotu metofonorusta ,ArperupaHe vu 3a6paBAHe” B OOnacTTa Ha 
pa3y3HaBaHeTO Ha 3annaxu? 


° OCHOBMTe Ha CTapTUpaHeToO, NOAAbPXKaHeTO UV yNpaBsIEHUeTO Ha Nporpama 3a pa3y3HaBaHe 
Ha 3ansaxuv B UAsaTa KOMNaHMA 3a HAYNHaeLlin 


« Kak da o6yyute BaALUUTe AHAJIUZATOPU 3a Pa3Y3HABAHE Ha 3alMjlaxu fla ObaaTt poK 3Be3Qu 
Ha UHAYCTPUATA 3a CUFYPHOCT U AHANUTUYHUTE VU TEXHUYECKU POK 3Be3 qu? 


Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in 
Bulgarian: 
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Dancho Danchey 

indapendent Contractor 
hitpsviiddanchey blogspot.com 
Email: dancho.danc praiaah com 
+35987 6893890 


In case you’re interested in inquiring about individual or group OSINT or threat intelligence 
training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 


1 
2. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf 

3 

‘ 
5 
6. 


. https://ddanchev. blogspot .com/ 


ttps://archive. org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Th: 


eat_Actors_Analysis_2021-2.pdf 


ttps://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kibe 


Razuznavane_Memoar_02.pdf 


ttps://archive.org/download/dancho-danchev-cyber-security-talks—bulgaria-2022-video-presentation-01/Da 


ho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre 
9. https://archive.org/details/rsa-europe-presentation-01 


ttps://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2 


1.4.8 Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgar- 
ian - Part One (2023-06-05 01:11) 


[1] 
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ABOUTUS ie 
Dancho Danchev Presents 


Danche Danchev is an internationally recognized 
cybercrime researcher security blogger OSINT analyst and 
threat intelligence analyst that's currently running one of 
the sacurity industry's most popular security publications 


his personal blog - https, /ddanchev blagspot com Sines hee tive 
ee individual 

BASIC AND ADVANCED 
OSINT AND THREAT INTELLIENCE 
- ‘ ] PROGRAM BUILDING AND TRAINING 


REACH US - 


+359876893890 


Email: dancho.danchev@hush.com 


https; //ddanchev.blogspot.com 


HTTPS://DDANCHEV BLOGSPOT.COM 


I’ve decided to share with everyone a recently released YouTube video demonstration in 
Bulgarian on the topic of OSINT and threat intelligence training. 


Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in 
Bulgarian: 


Kon ce UHTepecyBa OT VHAUBUAYAaNHO wsM FpynoBo ObyyeHve B Ccbepata Ha OSINT aHanv3 u 
npeBeHuNMA Ha KUOep NpecTEnneHua VU aHanu3 U OOpaboTtka Ha Kubep aTakuV U3BeECTEeH OLE 
KaTO NpakTukKaTa Threat Intelligence? Moxete ga BuguTe MoeTO CV TykK - 
[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev _CV 
_2021.pdf noptcdbonuo oT aHanu3u uv npoyyBaHua oT 2005 Ao 2023 Tyk - 
[3]https://archive.org/details/@ddanchev Bugeo QEMOHCTpalWN TyK - 
[4]https://youtube.com/@ddanchev u moa KypHan TykK - [5]https://ddanchev.blogspot.com 
TeMOHCTpPAaLNA 3a HAYYEHOTO TYK - 
[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys 
is-2021-2/Dancho Danchev Cyber Threat Actors Analysis 2021-2.pdf kKakTo u Moa 
MeMOap Ha Bbsirapckyu TykK - 
[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn 
iga-O1-memoar/Dancho Danchev _Kiber Razuznavane Memoar _02.pdf KakTo u Bugeo OT 
nocnegHua Cyber Security Talks Bulgaria - 
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[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga 
ria-2022-video-presentation-01/Dancho Danchev Cyber Security Talks Bulgaria 2022 
_Video Presentation 01.mp4 kakTo uv BCUYKU MOU Npe3ZeHTALMN TyK - 
[9]https://archive.org/details/rsa-europe-presentation-01 KakTo uw BCMUYKUM MoU NpakTUYeCKU 
aHau3u Ha Ku6ep atau 3a MOA paboTosaTen TyK - 
[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull 
etproof-infrastructure-2 


NpumepuHua kypc 3a OSINT o6yy4eHue KONTO NpegANaraM BKJIOUBAa: 


¢ HocturaHe go WU3sTOYHUKa Ha Kubep Atakata [lo Bpeme Ha AHanu3a Ha WHcdopmauna c 
Ny6nnu4Hu U3stouHuun 


¢ U3non3BaHe Ha Pa3y3HaBaHe Ha WHcbopmauna c Ny6nuyHu U3TOYHMuY B aHasu3a Ha Kubep 
aTaku 


¢ W3n0n3BaHe Ha Pa3y3HaBaHe Ha WUHdopmaunsa c My6nuyHu U3ToYHuuN B 6bopbaTa c 
npecTbnneHuata 


¢ Kon e DaHyo DaHyes? 
* Kou Ca HAKON OT TeEKYLUUTE MU UV ObAeELWM NpoeKTHU B Ccepata? 


¢ OOoraTABaHe Ha UHGopmauuata no Bpeme Ha AHanu3a Ha UHdbopmauua c NMyonnyHu 
VU3TOYHULIN 


* OCHOBM Ha Pa3y3HaBaHeTO C NyOnuy4Hn U3TOYHUUNM Ha UHcbopmauna 


¢ MpakTuyecka JemMoHctTpauna Ha AHanu3 Ha Unqbopmauna c Ny6nuyHu U3TouHuun 


Npaktuyecku Npumepu Ha AHanu3 Ha Wncdbopmauna c My6nuyHu U3TOYHULM 
¢ MpakTuyecKU CbBeTU NO Bpeme Ha AHasv3a Ha WHdbopmauna c Ny6nuyHn U3stToYHuuUN 
¢ MpegctaBaAHe Ha Kypca 


* CbOupaHe Ha TexHunyecka WHcbopmauna no Bpeme Ha AHasu3a Ha WHcbopmauna c Ny6nuyHn 
U3TOYHUNUN 3a HanpegHasn 


¢ CbOupaHe Ha TexHunyecka WHcbopmauna no Bpeme Ha AHasu3a Ha WHcbopmauna c Ny6nuyHn 
V3TOUHNLM 3a HaywHaeun 


¢ TakTuku vu Metogonoruu 3a HayHaelln 
¢ TakTukKu uv Metotogonorunu 3a HanpegHann 


¢ TeKyLuO CbCTOAHNeE Ha Na3apa 3a NpogsyKTU UU ycnyru cBbp3aHuv c Pa3y3HaBaHe Ha 
aVHcdopmauna c My6nuyHn U3TOYHULM Ha UHcbopmauna 


¢ MuHaneH U3nut vu Benpocu 

Mpumep kypc no threat intelligence KONTO npegANaraMm BK/IIOUBa: 

¢ Bop6a c KuObepnpecTBnNHOCcTTa B KOHTeKCTAa Ha U3NO/I3BaHe Ha UH*opmawwaA 3a 3annaxu 
¢ BbAeuwweTO Ha pa3y3HaBaHeTO Ha 3annaxu 


¢ YCbBbPLUCHCTBAaHY NpakTUKM 3a pa3y3HaBaHe Ha 3ansaxuv KOHWeNLMM UW MeTOgONOrUN - 
NpaktTuyecku npumep 


¢ BbBegeHune 


* Kak ga u3non3Bate ny6nnuyHu uv coOcTBeHuY 6a3U DaHHU 3a pa3y3HaBaHe Ha 3annaxu 
3a KaMnaHUuN 3a NpwunucBaHe Ha yYaCTHULM B KYUOepHeTMYHU 3annNaxu, BKIOYUTeENHO 
KPpbCTOCAaHU NpenpaTkKU VU KPbCTOCaHA NpoBepKa 
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* Kak ga oOoratTute loC 3a yAnatTa Cv KomMNaHMA (VHANKaTOPUN 3a KOMNpOMeTUpaHe) C 
nomouwtTa Ha nyOnnyHu uv cO6cTBeHVY U3TOYHULIY UYU fa CBbpxKeTe TOYKUTe NpUY ronaAmMa 
Kubepataka UW KamMnaHuUA 3a AKTbOP B KUOepHeTUYHa 3annaxa 


¢ W3non3BaHe Ha OSINT B KOHTeKCTa Ha CbOupaHe Ha UHCopmawnaA 3a 3anNaxu 


¢ W3scnenBaHe Ha KYvOepnpecTbnneHnA UU pa3y3HaBaHe Ha 3annaxu loC (WUHAUKaTOp 3a 
KOmMNpomuc) Ob6oraTABaHe B KOHTeKCTa Ha U3NO/3BaHe Ha OSINT 


¢ MpakTukata 3a 6opba c KubepnpecTEnneHuaTa 4pe3 pa3y3HaBaHe Ha 3anNaxu 

° KOHLENLNN 3a Ppa3y3HaBaHe Ha 3ansNaxu 3a HAaYMHaeLV 

¢ MeTOgZoNOrMuu 3a NPOAKTUBHO pa3y3HaBaHe Ha 3ansNaxu 

* MeTogonorun 3a pa3y3HaBaHe Ha 3annaxu 

* O6oraTABaHe Ha UH*opmMauNA 3a 3aNnNaXV B KOHTEKCTA Ha U3NON3BaHe Ha OSINT 


* Kak da NpeBbpHeTe BaLUUTe KNNeCHTM B NACVBHY VU aKTUBHY pa3snpegeneHu CeH30pV 3a 
CbOupaHe Ha UHopmauivaA 3a 3annaxu? 


* OCHOBU Ha Ppa3Y3HaBaHeTO Ha 3alNsaxu 


° Pa3LUNPeHO PYHKLIMOHMpaHe VU NOAAbP»KaHe Ha Nporpama 3a pa3y3HaBaHe Ha 3ansaXxu B 
luanatTa KOMNAHNMA 3a HanpesAHanu noTpebuTenn 


¢ MpakTUyecku CbBeETU 3a pa3y3HaBaHe Ha 3amsaxu 
* OCHOBUTe Ha 3a€NOYBaHeTO Ha pa3y3HaBaHe Ha 3anNaxu 3a HAYNHAeLUN 
¢ Pa3y3HaBaHe Ha 3amlaxu B KOHTeKCTa Ha KUbepataka. 


ba Pa3y3HaBaHe Ha 3alnslaxXuUTe B KOHTCKCTaA Ha U3NOJISBAHE Ha TEXHUYECKO CbOupaHe 3a aTaKU 
C NPUNUCBAHE Ha AKTbOP Ha KUOepHeTU4Ha 3anslaxa 


° Pa3LUNPeHU KOHLIENLIWM 3a pa3sy3HaBaHe Ha 3amaxn 


¢ Kak ga npeoOpa3yBate KpaWHuTe TOYKUY Ha cnyxKuTenuTe Ha BalwaTa KOMNAHUA B 
pa3npegeneH CeH30p 3a CbOuUpaHe Ha UH*opMauWA 3a NACUBHU VU AKTUBHU pa3y3HaBaHuA 
3a 3annaxu? 


¢ TeKYLUO CbCTOAHMe Ha CKOCUCTeEMaTa 3a pa3y3HaBaHe Ha 3ansNaxu 
¢ TeKYLUO CbCTOAHME Ha Na3apa 3a pa3y3HaBaHe Ha 3annaxn 


¢ HavctuHa mu pabotu metofonorusta ,ArperupaHe vu 3a6paBAHe” B OOnacTTa Ha 
pa3y3HaBaHeTO Ha 3annaxu? 


° OCHOBMTe Ha CTapTUpaHeToO, NOAAbPXKaHeTO UV yNpaBsIEHUeTO Ha Nporpama 3a pa3y3HaBaHe 
Ha 3ansaxuv B UAsaTa KOMNaHMA 3a HAYNHaeLlin 


« Kak da o6yyute BaALUUTe AHAJIUZATOPU 3a Pa3Y3HABAHE Ha 3alMjlaxu fla ObaaTt poK 3Be3Qu 
Ha UHAYCTPUATA 3a CUFYPHOCT U AHANUTUYHUTE VU TEXHUYECKU POK 3Be3 qu? 


Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in 
Bulgarian: 
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Dancho Danchey 

indapendent Contractor 
https/ddanchay. blogspot.com 
Email: dancho.danchev@huah.com 
+359876893880 


In case you're interested in inquiring about individual or group OSINT or threat intelligence 
training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEjKanm71Gb6ZySklylzx8y89g_EG9Q3NN7oDf goGe-DJnoF 
ee 


ttps: if Aas septa ye individuals. com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021. pdf 


a rca ERT TE OOO TET 
4, https: //youtube,con/€ddanchev 
By 
6. 


ttps://ddanchev. blogspot .com/ 


ttps://archive. org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Th: 


eat_Actors_Analysis_2021-2.pdf 


ttps://archive. org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kibe 


Razuznavane_Memoar_02.pdf 


ttps://archive. org/download/dancho-danchev-cyber-security-talks—bulgaria-2022-video-presentation-01/Da 


ho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre 
9. https://archive.org/details/rsa-europe-presentation-01 


ttps://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2 


1.5 July 


1.5.1 Upcoming Release of a Biographical Cyber Security Visual Novel Game - Who 
Wants to Donate? (2023-07-07 19:55) 


[1] 
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Dear 


Happy summer or even better said how’s the summer in the context of having me announce 
my summer project which is basically a biographical Visual Novel game on which I’m working 
using Unity and Articy where the ultimate goal would be to present my story as a teenage 
hacker enthusiast throughout the 90’s up to present day where I’m a cybercrime researcher 
security blogger OSINT analyst and threat intelligence analyst which will consist of real-world 
people friends and colleagues from my online experience including colleagues and friends from 
the industry where my main goal would be to make this an unforgettable and educational and 
also mind and spirit provoking experience for everyone that I’ve work with online throughout 


Donate BuCoin: 1 9EWmk77omKtVgyrkDphviNJpovh2KsiTx 


Download fur Windows | Download fir Linus | Download fur Mac OS X| Download for Anatrvid | Download for IOS | Download for PS4 | Devwnload for PSS | Download for wOS 
Play Online with WebGL 


Cybocmse Wirt! Compury Gear © an sesryetye erst omteg edge gamer fat exper yrlryers see de Copies zal dye work! af cybercreue Wet om iagtdy reales prapbes and etree peerphy nechenca, So pune peovsles s esyer eel edfsrmanet eaperes 


| fr extievduaks seeking to wadereten! Ge ener withege of oDercemmal actetes Thrsagh a sere ofctelergre meuoes and sconces, plryors are grew the opportuat te nasa Ghroudh Veta ernment uorieer Hibeniines, cence sophateated heckeg 


jectneyoce aml vtenenh: Seferat agaest poscenl Oc threw The game ory ¢ cunpectemne pegte et cries aapects ofsybercranee ihe aberery thet socad mgmerrng nabeary atacis wud deta brredes In eddéoo © es ererrtamnest cabe, Cybercrime Weal 
Compuner Game abr serves as eo rfeone ntucatonal tol Sooterng anweenees abot celne secu peacacn mad equppen players wih tte keoilater imguent to geotect themerbes foo read world cyber dream ‘Wel i flares eaerance seal Competing marraies 
arucket, the giine sets a new etaefed Be the sterserne] berween guseg and cvoerremuny awareete 


A computes pene shout Dan Se Dashes hiegtegtn: Would ode an getteceie ant emmenine eigenen grecciey player rth ile opportesy to cokes ite Qicmeing BE of the ronan! ohenecer, expert Drang frm read Me oven. Ge ptt could utes by 
etsodus nip players no Decathes's cath yomy, ReMetees tet pemest bbw tectemkery eal hm pontal nile m comtetes eyherirme Tus ctemtey sey eieg eel seerphey meviases, plevcr woudl tecgeyte a ees ef leink expend ty eemaie at mabstcors Dstt 
Be They wend ceeueeer heteages Sat merce bes prefersmentl ataggies each on demeertng comics mubears attacks ot secoverng soptinterated hacking teckexzars The gece: toukl shop shed tytt-ont bes eedetions corperstrat to eect safety anal aepphatsite be actne 
enobemert & Aa! otenecury mean Accessing a dose nesrecte crescred stovesd roa) worl accooeptetenmss, thee crmgrers pane eon ret onde rrecrmen plyers bet ako pis dem show Se rmralinh ofcyterscuses présente Ber Daehn 
Dhara 


The Cytercrame World Vieual Novel Game 6 6 apeeory and Grieg geeeg eqeteme wt ude dazk taxierbeDy of the digead week! The spercine ery dives pee eemerics players me prppee norte centeved arcand coberome scutes, aheoe they assume Oe 
nol if an asym hacker seeing deere aes! forune wvbe: tm chistester wotlt The gis eneg vw ed reabor ilepeton cfhackng teedeeyes ctuere the wvevel pemey esperesee, proviies phryens wath an eadenne ging wm the mmraces af vtertearal 
openmem Wehr meeteucadk coated sonine Ged ech oreepecesd pit trem and eupesefil merit phon wil dad Demenhies ergmesed no world Sa of dacges ant decee Moreover, fe pate cecornper croval thadee eal prohk=s sohwe ckife or phivers 
feria Qrough smears pearing brypaee sccurey syvieem and coment sale 3p iterated) eranege ot @ cenerinesl “cybechuid * Ueetouttedd) hee enatne vival cert & pone te capemete genet who wetk sage. chuleeee ent 0 snmerent eepdtuton ese Ge ttabnaf 
evbercreas 


A vm act! congnéss game then hacker contin te manent senteleg of tun peck wth the emmane worl of rberecueny, Sree phere a mage eal metceg Operas The gecer cet ond debe eee de ecbewcal experts bet abe exmpbre: heal 
eqplesees anf prea Sioa fealty backers Thesesh tesatetd) devant narraten, plscers are able os grap Comples tering ichemyey, bears chou daeal eerue: peetere aml ean gugtits rt the mentee deny dew chasscere The gmme satresam to dread 
st rakes: portrayal oftackeg artemes allows phyrr t rarer Srough a weer rarer iif aonenns, dome iniratag lee ercurty wees © iazaveheg saree compsacis Mocrever, the pau can weror as an pducatoatl iool promotng 4 heoudrr aeederstuaing of 


honesty concepts while cepertanng pemets eh fs Captionteg potions Utsnetety 9 vesal novel computer game aboot hackers nffers a proftyeenal yet deiieg expenenee be toch technology erttenaee and dose veri to oqend thes knowledge m te mer ohne! 
| Sekt 


blog readers, 


the years. 
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[2] 


Special thanks to [3]Elitecy Stuart for the hard work. 


Here’s a teaser: 


"Cybercrime World Computer Game is an innovative and cutting-edge game that immerses 
players into the complex and dynamic world of cybercrimes. With its highly realistic graph- 
ics and intricate gameplay mechanics, this game provides a unique and informative expe- 
rience for individuals seeking to understand the inner workings of cybercriminal activities. 
Through a series of challenging missions and scenarios, players are given the opportunity to 
navigate through virtual environments, uncover vulnerabilities, execute sophisticated hacking 
techniques, and ultimately defend against potential cyber threats. The game offers a com- 
prehensive insight into various aspects of cybercrimes like identity theft, social engineering, 
malware attacks, and data breaches. In addition to its entertainment value, Cybercrime World 
Computer Game also serves as an effective educational tool, fostering awareness about online 
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security practices and equipping players with the knowledge required to protect themselves 
from real-world cyber threats. With its flawless execution and compelling narrative structure, 
this game sets a new standard for the intersection between gaming and cybersecurity aware- 
ness. A computer game about Dancho Danchev’s biography would offer an interactive and 
immersive experience, presenting players with the opportunity to explore the fascinating life 
of this renowned cybersecurity expert. Drawing from real-life events, the game could start by 
introducing players to Danchev’s early years, highlighting his passion for technology and his 
pivotal role in combating cybercrime. Through captivating storytelling and gameplay mechan- 
ics, players would navigate a series of levels inspired by significant milestones in Danchev’s 
life. They would encounter challenges that mirror his professional struggles, such as dissecting 
complex malware attacks or uncovering sophisticated hacking techniques. 


The game could also shed light on his relentless commitment to internet safety and empha- 
size his active involvement in global cybersecurity initiatives. By creating a dynamic narrative 
centered around real-world accomplishments, this computer game would not only entertain 
players but also educate them about the crucial work of cybersecurity professionals like Dan- 
cho Danchev. The Cybercrime World Visual Novel Game is a captivating and thrilling gaming 
experience set in the dark underbelly of the digital world. This interactive story-driven game 
immerses players in a gripping narrative centered around cybercrime activities, where they 
assume the role of an aspiring hacker seeking fame and fortune within this clandestine world. 
The game’s stunning visuals and realistic depiction of hacking techniques enhance the overall 
gaming experience, providing players with an authentic glimpse into the intricacies of cyber- 
criminal operations. With its meticulously crafted storyline filled with unexpected plot twists 
and suspenseful moments, players will find themselves engrossed in a world full of danger and 
deceit. Moreover, the game encourages critical thinking and problem-solving skills as players 
navigate through intricate puzzles, bypass security systems, and outsmart rivals to ultimately 
emerge as a renowned "cyberlord." Undoubtedly, this innovative visual novel is poised to cap- 
tivate gamers who seek intrigue, challenge, and an immersive exploration into the realm of 
cybercrimes. 


A visual novel computer game about hackers combines the immersive storytelling of visual 
novels with the intriguing world of cybersecurity, offering players a unique and engaging 
experience. This genre not only delves into the technical aspects but also explores ethical 
implications and personal dilemmas faced by hackers. Through thoughtfully designed nar- 
ratives, players are able to grasp complex hacking techniques, learn about digital security 
practices, and gain insights into the motives driving these characters. The game’s attention 
to detail and realistic portrayal of hacking activities allows players to navigate through a wide 
range of scenarios, from infiltrating high-security systems to unraveling intricate conspiracies. 
Moreover, this game can serve as an educational tool, promoting a broader understanding of 
cybersecurity concepts while entertaining gamers with its captivating plotlines. Ultimately, a 
visual novel computer game about hackers offers a professional yet thrilling experience for 
both technology enthusiasts and those seeking to expand their knowledge in this ever-evolving 
field." 


Sample screenshots include: 


[4] 
1038 


[5] 


[6] 


Anthony Aykut - 


Linzi 


Coney Me et iat 


Wv awe amd Count tery pow ts amcat fir ax! Wat Cs pow fave ween eh? 


[7] 
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So here’s the news? Who wants to sponsor me for this project and for its release in a timely 
manner preferably before the end of the summer? It would be really great if you’re an orga- 
nization or a vendor where I’m full of ideas in terms of how | can give proper credit for your 
donation or sponsorship. 


Drop me a line at dancho.danchev@hush.com in case you’re interested in sponsoring my 
project or in case you might have any ideas on terms of how you can contribute here such 
as for instance a Unity developer or a game Script writer. 


Stay tuned! 


1. https: //blogger.googleusercontent.com/img/b/R29vZ2x1/AVVXsEj tW3Wcct QdfQaKCPseolq9gY0miFNCBmRAQFqOD4BF JXPvg 
Etn5PdYU2_F5ZZCAR_ZjszfTUrzEQXZp5L7Gz0a8B01115r4zuxF3W 

2. https://blogger . googleusercontent . com/img/a/AVvXsEhtXfij_stSQb8pjazdMtCsMs-9J2Y_vuiXmviaUaBuJfXG-IHf0Pfewl 
x0x5AJ73uRBBdMg JzyR40ySdYQM-SetGobCo_jPeRTbK80jqL5znxQ 

3. https: //www.facebook. com/profile. php? id=100088482332570 

4. https://blogger . googleusercontent .com/img/b/R29vZ2x1/AVVXsEi7x1Mxgj82XpVodfHYmTZj v6Lwg276zYhps3WL8t 16SsASF 
huvRiaqbjfxeGI JCGyiNacAAYOv5DQnpvCWOODIt 3KeEXiVD4G0pjH 

5. https: //blogger . googleusercontent . com/img/b/R29vZ2x1/AVvXsEj I-n1z610DUYLjxLiAf 2SWWEbmmIXFcd1icZ10zp7naziSq 
tanJ-e6FjO0ASbJs9i59E8sVa4qSzhJ258ITEx0JxsEScO1Jj jmhQPD 

6. https: //blogger. googleusercontent.com/img/b/R29vZ2x1/AVvXsEi lw0u2gy4GbVEf 1G2GYqtNShzURIj jR7ORBkKFSVM1913bUh 
yKIetF1ldVMoqlq_yKy08DAoq1iN7H4B_3d3H9C4731_Wjn6o0BN40kFa 

7. bttps://blogger . googleusercontent .com/img/b/R29VZ2x1/AVVXsEjrgxvNOBDNhwst vzfxsB9W9101xi4wQDxiZ4r6Q0-uigc02 
4WkZazHOgtL4i9s2xhulLfk1DOWdQqBhyZxIgjxLLz5LoiQusrcmbU 
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1.5.2 Who’s on Wikipedia? (2023-07-20 12:00) 


Dear blog readers, 


Who’s on Wikipedia is an Editor or can forward [1]this to their friends on Wikipedia? 


[2] 


—— 


oe 


rA 


—_—_ 
——_—————— = 
-_— 


It’s a [3]Draft about me and my experience in the field which you can assist in Editing and 
contributing to using a set of [4]links and resources which I’ve prepared including to assist in 
adding references from [5]Google Books and [6]Google Scholar. 


Stay tuned. 


1. https://en.wikipedia.org/wiki/Draft :Dancho_Danche 
2. https: //blogger .googleusercontent .com/img/a/AVvXsEiuVkg01iMaleo9hfGC0jS3rFRXh88c18-LWmFieY1J687BEyaSVX65wE 


4Wf£YMA8DQmx- uPgHupT JriFgZLkOThLZHWj ypMAauhJi7KML7 jSOkC 

3. https://en. wikipedia. org/wiki/Draft : Dancho_Danchev 

4. https://drive.google.com/file/d/1a9_OsaA0jLkzMotmATemMvUagYPoBYuk/view?usp=drivesdk 

5. https: //www. google. com/search?tbm=bks&q=/2522dancho+danchev/,2522 

6. https: //scholar.google.com/scholar?hl=enkas_sdt=0/252C5&q=7,2522dancho+danchev/,2522&btnG=kog= 


1.5.3 Exposing the Internet-Connected Infrastructure of FBI’s Most Wanted Igor De- 
htyarchuk - "Floraby" - An OSINT Analysis (2023-07-25 14:54) 


[1] 


Dear blog readers, 


I’ve decided to share some actionable intelligence on the Internet-connected infrastructure of 
FBI’s Most Wanted - [2]lgor Dehtyarchuk - "Floraby" with the idea to assist everyone doing 
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research on the topic including U.S Law Enforcement on its way to track down and monitor this 


individual and his associated Internet-connected properties. 


Sample emails known to have been involved in the campaign include: 


abuse@shopsn.su 
dimetr801@mail.ru 
admin@4server.su 
ssg.apple77@gmail.com 


Sample domains known to have been involved in the campaign include: 


4server.su 
csgoacc.ru 
marketsales.su 
zarmo.su 
4domains.su 
ebayshop.su 
globus-base.su 
broshop.su 
deer.su 
shopsn.su 
cjmarket.net 
vkaccounts.com 
cheapaccounts.su 
ytuber.su 
vds4u.su 
A4host.su 
tgshop.su 
xn-227-qdd4dec.xn-placf 
4dedic.su 
time-hack.su 
4ns.su 


Sample screenshot: 


[3] 


1043 


tee ae 
4senersu osgoacc iu mathetsales.su Zarmo.su 4Sdomainssu 
— @ o— 4 r+— -—. 
@ — @ @) @ 
ebayshop.su globusbase. sy broshop isu deetsu shopsn.su 
® © © © © 
@ S y) ¥ 
cjmaiket.net vkaccounts,com cheapaccounts.su ytubersu vds4uesu 
“ Sa —. * * 
& @ _— — —_ 
4host.su tgshop.su 4ins-su Adedicsu tim=hack.su 


Stay tuned! 


1. https: //blogger. googleusercontent . com/img/b/R29vZ2x1/AVVXsEj 85uNWPxkQrkt I 0GAU0 J9qU£DyRoMEp1QV2JNxHLW£D8q18 
a41xSNcM7x_s3Y_HscY3gHKqobnDqHWcT J-xNAEny17zKsZj37E099 
2. https: //www.fbi.gov/wanted/cyber/igor-dekhtyarchuk 


3. https: //blogger . googleusercontent .com/img/b/R29vZ2x1/AVVXsEi9S_buJXZAq8Dt vWo7BiL45vXRrL3KEGOvAy4AGvCtrOhIc 
YG9z1514yKMI gd8i1YzNvWmhyFFnaAG6j8haTIqC3cT11l7vtMtxkw 


1.5.4 Dancho Danchev’s Disappearance - 2010 - Official Complaint Against Re- 
public of Bulgaria Regarding Dancho Danchev’s Illegal Law Enforcement Ar- 
rest Home Molestation and Kidnapping Attempt - A Compilation - Part Two 
(2023-07-27 23:22) 


[2]Define: peasant forgetting the true reality of non-existence in the universal wannabe 
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agricultural economy referred to as the very bottom of Eastern Europe. 


The following is yet another official complaint part of the compilation of official complaints for 
the exact same people that kidnapped me from my place back in 2010 with my stolen ID which 
resulted in illegal detention for four months without anyone knowing and without any sort of 
explanation up to present day for which | warned in advance and $85,000 later which | legally 
earned and lost due to home molestation and on purpose drug poisoning courtesy of Bulgaria’s 
DANS agency in combination with local peasants and savages from Bulgarian Law Enforcement 
from the city of Troyan, Bulgaria which is my hometown. 


Whether it’s through modest complaints or through other means | promise that | will do my 
best to shed more light and continue elaborating more on this case from Bulgaria and three 
and five years and $85,000 legally earned and lost due to on purpose poisoning through other 
means other than this case of supreme idiocity and easy to detect and spot local degree of 
idiocity and peasant-eria with no explanation up to present day. 


Is it a bottom is it a bottom line or is it the bottom line in the very bottom line of yours? | 
promise that I'll soon take the time and effort and elaborate in-depth on the degree of savagery 
and moronic - apologies there’s no such word when it comes to my hometown - peasantaria 
and idiocy of the people living in my hometown Troyan, Bulgaria including the very bottom of 
what’s invisible to others in the true spirit of what some others would describe as something 
that | won't tell you which is guess what - it’s the very bottom of Eastern Europe. 


Whether it’s behold yourself to the almighty savior I’m not your savior or behold your almighty 
savior person and the very bottom of the dipshits that "make it happen" at their place every 
night are going to truly regret it using legal means or at the end we are going to find you a 
decent place buy it so that you can rent it and eventually for the blessing of everyone that truly 
knows you commit suicide in the true spirit of spending the irrelevance of your existence where 
it belongs in the place that we bought and that you rented and where you committed suicide 
or in the other place where all of your relatives belong. | won’t say but the very smells of your 
enticing existence tends to point to everyone’s favorite place for Bulgarian lifestyle dipshits 
and irrelevant to the universal irrelevance of your existence place. Guess what? That’s not my 
place. 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEj Jz1WJFOzDCLHoaMCxMQf Yk3k0Zs6wpANUraAyMuorPU8js 
pRduooe7i-fbS11-9hTW_3ejqcKxFsBxnIteiukPqfFW7SfA615a_ 
2. https://www.google.com/search?q=def ine/%3Apeasant 


1.5.5 Cyber Intelligence - Second Edition - Released (2023-07-31 02:55) 


[1] 
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The Ultimate 
Ever-Green Second 
Edition of Dancho 

LDanchevs Cyber 


[Intelligence Memoir 


rime tinderworid 


w We Sr (Jn thie 
undation 


intelligence 


Grab a [2]PDF or [3]ePub copy from [4]here including the full archive [5]here today. 


Stay tuned! 


1. https: //blogger. googleusercontent.com/img/b/R29vZ2x1/AVVXsEj jBkGifzLAIdPVMQu3iEqt 1p21XSc40B1PWAeUjvc5dSkdm 
8JbnW1lpYOcZGHGePoiLR_AwTPgqLr3scpDy0IdFPR2EcwkKn8Rt Y1-CM 


1.6 August 


1.6.1 Embassy of China in Canada Issues a Statement on U.S Cyber Espionage Cam- 
paigns Against Japan (2023-08-11 22:00) 


[1] 


TEARS Km Oe 


EMBASSY OF THE PEOPLE'S REPUBLIC OF CHINA IN CANADA 


| just came across to a statement issued by the Embassy of China in Canada on the [2]U.S 
cyber espionage campaigns launched against Japan. 


What’s so special about this statement? First it does quite Wikileaks which is a bit of an 
outdated approach including the actual source to shed more light into a bigger problem and 
issue for China that the press statement on the Web site of the Chinese Embassy in Canada 
mentions. In this specific case the statement implies the use of the so called "hunt-forward" 
missions which could really mean big trouble for China if the U.S somehow manages to secure 
a deal with a neighbouring country next to China which could really mean big trouble for 
China as the U.S will then attempt to establish the foundation for a successful cyber attacks 
and possibly information operations interception campaigns used managed and operated by 
China including its partners and allies where to ultimate goal would be to measure their true 
capabilities and set the foundation for a successful cyber situational awareness campaign in 
terms of cyber attacks and the true state of China’s true cyberspace operations and cyber 
attack capabilities including the capabilities of some of its neighbouring countries. 


The so called [3]Hunt Forward Operations also known as (HFOs) are an early warning system 
for cyber situational awareness that could improve the true state of the visibility of the actual 
country that’s doing these missions in this specific case the U.S could really learn a lot about 
new tactics and techniques courtesy of the attackers based in the specific country where it’s 
hosting its mission which could be really bad news for China in terms of having the U.S deploy 
hunt forward missions in its neighbouring countries where the U.S could really get a better 
picture of China’s understanding and actual applicability of basic cyber warfare principles and 
concepts in action including the "know-how" of its neighbouring countries. 


Despite the fact that the U.S is willing to share its knowledge and understanding of cyber 
attacks "know-how" with the host country of a hunt forward mission it could also learn a lot 
about the cyber attacks that originate from the host country and possibly improve its own 
situational awareness in the field including from a geographical perspective. 


Happy hunting. 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEjhtnFi-vJBN_HNbHOS5Z82c JGUUDkLbHykIhAFaDGOh5zK _ 
ZP415WJhemgzLA- yo2YzcyvY6r0m_NEwN1DPQO2eacChEtBSSwaxk 
. http://ca.china-embassy.gov.cn/eng/fyrth/202308/t20230810_11125180.htm 


2 
3. https://www.cybercom.mil/Media/News/Article/3218642/cyber-101-hunt-forward-operations/ 
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1.6.2 A Portfolio of Publicly Accessible Cybercrime Friendly Forum Communities 
(2023-08-11 22:01) 


Installs 


We <sefling high- awality instells, loads, download to bets, rats, stealers.. All * EXE allowed, just be fud. Fresh bots come every day 


Adib’ ©bitcoin 


Who needs access to a recently collected portfolio of publicly accessible cybercrime friendly 
forum communities for Technical Collection and situational awareness? 


| recently spend some time doing my homework on the topic in terms of improving my Cyber- 
crime Forum Data Set and | decided to share the findings with everyone. 


Sample publicly accessible cybercrime-friendly forum communities include: 
hxxp://crdforum.cc/ 

hxxp://darkwebmafias.net/ 

hxxp://darkstash.com/ 

hxxp://crdpro.cc/ 

hxxp://www.cardingclub.net/ 

hxxp://www.russiancarders.se/ 
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hxxp://validmarket.io/ 
hxxp://cardingforum.cx/ 
hxxp://carding.sh/ 
hxxp://bitcarder.com 


hxxp://cardingleaks.ws/ 


hxxp://www.verifiedcarder.net/ 


hxxp://www.legitcarder.ru/ 
hxxp://www.crdworld.com/ 
hxxp://cardingmafia.to/ 
hxxp://cardingforum.cx 
hxxp://crdforum.cc 
hxxp://darkstash.com 
hxxp://carders. biz 
hxxp://crdpro.cc 
hxxp://carders.mx 
hxxp://carding-forum.com 
hxxp://crdclub.su 
hxxp://procrd.pw 
hxxp://cardmafia.cc 
hxxp://cardingforum.info 
hxxp://cardingleaks.ws 
hxxp://darkpro.net 
hxxp://crackingforum.to 
hxxp://cardingworld.ru 
hxxp://darkwebmafias.ws 
hxxp://leetforums.ru 
hxxp://legitcarders.ws 
hxxp://crdcrew.cc 
hxxp://prtship.pro 
hxxp://verifiedcarder.net 
hxxp://legitcarder.ru 
hxxp://carders.zone 
hxxp://drdark.ru 
hxxp://darknetweb.ru 


hxxp://bpcforum.ru 
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hxxp://wc-club.com 
hxxp://cybercarders.com 
hxxp://bitorder.pw 
hxxp://cardingforum.cx/ 
hxxp://crdpro.cc/ 
hxxp://darkpro.net/ 
hxxp://deeptor.ws/ 
hxxp://www.verifiedcarder.net/ 
hxxp://crdforum.cc/ 
hxxp://crdcrew.cc/ 
hxxp://legitcarder.ru/ 
hxxp://blackhatcarding.is/ 
hxxp://legitcarders.ws/ 
hxxp://leetforums.ru/ 
hxxp://deepwebforum.net/ 
hxxp://darkwebmafias.ws/ 
hxxp://crdclub.su/ 
hxxp://www.cardingworld.ru/ 
hxxp://russiancarder.net/ 
hxxp://underworldmafias.net/ 
http://www.cardersteam.com 
hxxp://carding.work/ 
hxxp://cybercarders.com/ 
hxxp://blacknetworld.com/ 
http://carding.pw/ 
hxxp://carders.biz/ 
hxxp://verified.international/ 
hxxp://cardingfree.com/ 
hxxp://drdark.ru/ 
hxxp://shadowcarders.com/ 
hxxp://cardingstuff.ws/ 
hxxp://carders-club.com/ 
hxxp://sky-fraud.net/ 
hxxp://darkteam.su/ 
hxxp://trustedsellers.ws/ 
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hxxp://bitorder. pw/ 
hxxp://www.legitmafia.ws 
hxxp://carding.pw/ 
hxxp://cardingleaks.ws/ 
hxxp://darkstash.com/ 
hxxp://www.deepwebforum.net/ 
hxxp://legitmafia.ws 
hxxp://carders.mx/ 
hxxp://cardingforums.org 
hxxp://procrd.pw/ 
hxxp://cardvilla.cc/ 
hxxp://cardingclub.ws/ 
http://www.cardersteam.com/ 
hxxp://darkpro.net 
hxxp://carders.zone/ 
hxxp://www.prtship.pro/ 
hxxp://carding-forum.com/ 
hxxp://cardmafia.cc/ 
hxxp://cardingforum.info 
hxxp://crackingforum.to/ 
hxxp://prtship.pro/ 
hxxp://darknetweb.ru/ 
hxxp://www.bpcforum.ru/ 
hxxp://wc-club.com/ 


Happy Technical Collection. 
1. https: //blogger.googleusercontent .com/img/b/R29VZ2x1/AVvXsEgXLequAvEhoNXtHwGc_x5YDbr280wdpBZqDPsnXGo6FAHK 


TyqYK20rUWGmF’7 6S3sdQQwhJ8aSu- 1xbN1BL_NzwnbbocMUaW1PgK j 


1.6.3 A Portfolio of Iran-Based Hacker Groups and Lone Iran-based Hackers Personal 
Web Sites (2023-08-11 22:01) 


[1] 
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= 
Dancha Danchey Presents! Brace Yourselves! 


Grab today a free copy of the Second Free Eg 

"Exposing Iran's Hacking Scene OSINT-E 

Technica gonection Empowered and Visualized Reperd 
Priced at $500 foran Unlimited Distribution Amon 


Organization including Individual Researcher Use - the s 
the Most Comprehensive and Technicall te 


Analysis of iran’s eee Scene mH to-Date! 


Commercial Copy Available! Apo roach me taday! 
at i Manaper today! Empower your Threat 
gam! An OS! NT Condorted Oday is 2 
Tax Payer's Dallar Seved Tomorrow! 
https://ddanchev blogspot.com 
Official OSINT Report Price - $500 


Technical Collection Data - Exclusive Email: dancho.danchev@hush.com 
Copy Available! 


In need of a freshly collected Iran-based hacker groups and lone hacker personal Web sites? 


As | did some homework on the topic of finding these | actually came across to the fact that 
the majority of these are located on an Iran-based hosting provider known as Persiangig.com 
and as I’ve decided to dig a little bit deeper | came across to and actually bothered to compile 
a portfolio of these Web sites which | decided to share with everyone ready here. 


Sample Iran-based hacker groups and lone hacker personal Web sites include: 
hxxp://adibii.persiangig.com/ 

hxxp://ahm4d-h4cker.persiangig.com/ 

hxxp://ahmadbady.persiangig.com/ 

hxxp://alipcl.persiangig.com/ 

hxxp://alireza5800.persiangig.com/ 

hxxp://anatema.persiangig.com/ 
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hxxp://anax2x.persiangig.com/ 
hxxp://any-thing.persiangig.com/ 
hxxp://artacyber.persiangig.com/ 
hxxp://arvineasthackers.persiangig.com/ 
hxxp://aware.persiangig.com/ 
hxxp://azazel.persiangig.com/ 
hxxp://barfobaran.persiangig.com/ 
hxxp://bigb4ng.persiangig.com/ 
hxxp://bl4ck-hat.persiangig.com/ 
hxxp://blackfox.persiangig.com/ 
hxxp://blackice.persiangig.com/ 
hxxp://bulurp.persiangig.com/ 
hxxp://cdn.persiangig.com/ 
hxxp://cld.persiangig.com/ 
hxxp://cr4zylov3r.persiangig.com/ 
hxxp://danial-secret.persiangig.com/ 
hxxp://drtrojan.persiangig.com/ 
hxxp://drwxrwxrwx.persiangig.com/ 
hxxp://ehsan-empire.persiangig.com/ 
hxxp://eshak.persiangig.com/ 
hxxp://farbodmahini.persiangig.com/ 
hxxp://freezer.persiangig.com/ 
hxxp://fun4ir.persiangig.com/ 
hxxp://g3n3rall-blackhat.persiangig.com/ 
hxxp://goodboy3113.persiangig.com/ 
hxxp://h3ktOrz.persiangig.com/ 
hxxp://h4med.persiangig.com/ 
hxxp://nashorblackhat.persiangig.com/ 
hxxp://nesam1955.persiangig.com/ 
hxxp://highersense.persiangig.com/ 
hxxp://hivO1.persiangig.com/ 
hxxp://hkhmerikhi.persiangig.com/ 
hxxp://hushy.persiangig.com/ 
hxxp://i3lue.persiangig.com/ 


hxxp://inf3cted.persiangig.com/ 
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hxxp://infohooman.persiangig.com/ 
hxxp://irsec.persiangig.com/ 
hxxp://java-mesh.persiangig.com/ 
hxxp://jimunix.persiangig.com/ 
hxxp://Karaji21.persiangig.com/ 
hxxp://kazemfdisk.persiangig.com/ 
hxxp://keent.persiangig.com/ 
hxxp://kingg8.persiangig.com/ 
hxxp://lahij.persiangig.com/ 
hxxp://lamon.persiangig.com/ 
hxxp://li-tex5.persiangig.com/ 
hxxp://lo0ord.persiangig.com/ 
hxxp://lordnitro.persiangig.com/ 
hxxp://Ivl3hr.persiangig.com/ 
hxxp://m4hd1.persiangig.com/ 
hxxp://mahdi45.persiangig.com/ 
hxxp://mamd00.persiangig.com/ 
hxxp://matin021.persiangig.com/ 
hxxp://medl01.persiangig.com/ 
hxxp://mefile.persiangig.com/ 
hxxp://mehdi456.persiangig.com/ 
hxxp://mehdy007.persiangig.com/ 
hxxp://mehran4u.persiangig.com/ 
hxxp://motakhases.persiangig.com/ 
hxxp://mr-bami.persiangig.com/ 
hxxp://mr-emiter.persiangig.com/ 
hxxp://mrzero.persiangig.com/ 
hxxp://Mx7xx.persiangig.com/ 
hxxp://noter.persiangig.com/ 
hxxp://omid3r.persiangig.com/ 
hxxp://optishock.persiangig.com/ 
hxxp://ra-ha.persiangig.com/ 
hxxp://rad1c4l.persiangig.com/ 
hxxp://rebell.persiangig.com/ 
hxxp://rking.persiangig.com/ 
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hxxp://s2z2m.persiangig.com/ 
hxxp://saeed-00x.persiangig.com/ 
hxxp://saiedsoft.persiangig.com/ 
hxxp://security-team.persiangig.com/ 
hxxp://sitl1.persiangig.com/ 
hxxp://spacktOre.persiangig.com/ 
hxxp://thr3at. persiangig.com/ 
hxxp://titaksecteam.persiangig.com/ 
hxxp://vampire-diaries. persiangig.com/ 
hxxp://veron.persiangig.com/ 
hxxp://virtualuniversityofshiraz.persiangig.com/ 
hxxp://virus45.persiangig.com/ 
hxxp://w00rm.persiangig.com/ 
hxxp://w3bbaz.persiangig.com/ 
hxxp://wanted1.persiangig.com/ 
hxxp://wantedst. persiangig.com/ 
hxxp://webzzz.persiangig.com/ 
hxxp://aamahmoodi.persiangig.com/ 
hxxp://abiposhan.persiangig.com/ 
hxxp://adonia.persiangig.com/ 
hxxp://ahmadgeo.persiangig.com/ 
hxxp://ahwazdownload.persiangig.com/ 
hxxp://armaninvisible.persiangig.com/ 
hxxp://armintanha.persiangig.com/ 
hxxp://azuitsociety.persiangig.com/ 
hxxp://backpacker.persiangig.com/ 
hxxp://barzan.persiangig.com/ 
hxxp://bergissub.persiangig.com/ 
hxxp://bl4cklOrd.persiangig.com/ 
hxxp://capitanmsf.persiangig.com/ 
hxxp://countalireza.persiangig.com/ 
hxxp://dade1496.persiangig.com/ 
hxxp://defcon.persiangig.com/ 
hxxp://devilinside.persiangig.com/ 


hxxp://diazpame10.persiangig.com/ 
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hxxp://djmehrab.persiangig.com/ 
hxxp://dl-myismailyk.persiangig.com/ 
hxxp://dondiego.persiangig.com/ 
hxxp://emperor.persiangig.com/ 
hxxp://eshraq.persiangig.com/ 
hxxp://essaji.persiangig.com/ 
hxxp://ezdaha.persiangig.com/ 
hxxp://ferancesco.persiangig.com/ 
hxxp://firebaxe.persiangig.com/ 
hxxp://geneticz.persiangig.com/ 
hxxp://ghorube-deltangi.persiangig.com/ 
hxxp://goldtrader.persiangig.com/ 
hxxp://nhamedoveisi.persiangig.com/ 
hxxp://haxOr.persiangig.com/ 
hxxp://ncthemep.persiangig.com/ 
hxxp://hezarto.persiangig.com/ 
hxxp://hoodshmand.persiangig.com/ 
hxxp://iaump.persiangig.com/ 
hxxp://ice-ex1rl.persiangig.com/ 
hxxp://in-pc.persiangig.com/ 
hxxp://index.persiangig.com/ 
hxxp://j-ghahraman.persiangig.com/ 
hxxp://jO0|bak-jOOmjOOme.persiangig.com/ 
hxxp://jaylan.persiangig.com/ 
hxxp://kamy4r.persiangig.com/ 
hxxp://kangan.persiangig.com/ 
hxxp://liveblack.persiangig.com/ 
hxxp://lockheed.persiangig.com/ 
hxxp://lordgame2.persiangig.com/ 
hxxp://loveskaraj.persiangig.com/ 
hxxp://mfoxihst.persiangig.com/ 
hxxp://millad.persiangig.com/ 
hxxp://mohammad2050.persiangig.com/ 
hxxp://mr-shayan2.persiangig.com/ 
hxxp://n-e-0.persiangig.com/ 
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hxxp://niceman.persiangig.com/ 
hxxp://omidvar8943.persiangig.com/ 
hxxp://oomarshal.persiangig.com/ 
hxxp://paniranist. persiangig.com/ 
hxxp://paulauster.persiangig.com/ 
hxxp://pedi7khat.persiangig.com/ 
hxxp://pixxfa.persiangig.com/ 
hxxp://port80.persiangig.com/ 
hxxp://psychstudent.persiangig.com/ 
hxxp://reversecoderteam.persiangig.com/ 
hxxp://rkrayaneh.persiangig.com/ 
hxxp://robo-paraax.persiangig.com/ 
hxxp://saeed-trojan.persiangig.com/ 
hxxp://samanguner.persiangig.com/ 
hxxp://Sarbaz-faz.persiangig.com/ 
hxxp://secr0Ot3r.persiangig.com/ 
hxxp://seidfmo.persiangig.com/ 
hxxp://shayani.persiangig.com/ 
hxxp://shoot.persiangig.com/ 
hxxp://smobasher.persiangig.com/ 
hxxp://sms2008.persiangig.com/ 
hxxp://soft91.persiangig.com/ 
hxxp://svvat.persiangig.com/ 
hxxp://syndrome.persiangig.com/ 
hxxp://tal-la.persiangig.com/ 
hxxp://terminator.persiangig.com/ 
hxxp://terror-hell.persiangig.com/ 
hxxp://un3ecure.persiangig.com/ 
hxxp://unicorn88.persiangig.com/ 
hxxp://vantil.persiangig.com/ 
hxxp://worlddata.persiangig.com/ 
hxxp://yasesefid.persiangig.com/ 
hxxp://zamanim.persiangig.com/ 
hxxp://zarmehr.persiangig.com/ 


hxxp://ahooeg.persiangig.com/ 
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hxxp://aloalo.persiangig.com/ 
hxxp://amir.persiangig.com/ 
hxxp://andisheyeziba.persiangig.com/ 
hxxp://ardallan.persiangig.com/ 
hxxp://arteshdambeldor.persiangig.com/ 
hxxp://behradaspik.persiangig.com/ 
hxxp://delsa.persiangig.com/ 
hxxp://deragon.persiangig.com/ 
hxxp://ehsun.persiangig.com/ 
hxxp://eldera2.persiangig.com/ 
hxxp://f-r-h.persiangig.com/ 
hxxp://faqgame.persiangig.com/ 
hxxp://greencity.persiangig.com/ 
hxxp://iceberg1990.persiangig.com/ 
hxxp://jegh-jeghe.persiangig.com/ 
hxxp://jomeegardi.persiangig.com/ 
hxxp://kordestan.persiangig.com/ 
hxxp://lol-h.persiangig.com/ 
hxxp://mahdi9647.persiangig.com/ 
hxxp://mamadi.persiangig.com/ 
hxxp://mamalbooter.persiangig.com/ 
hxxp://maroooon.persiangig.com/ 
hxxp://maskido.persiangig.com/ 
hxxp://masoudtanhha.persiangig.com/ 
hxxp://medrik1.persiangig.com/ 
hxxp://my-book31.persiangig.com/ 
hxxp://mycomputer89.persiangig.com/ 
hxxp://noclick.persiangig.com/ 
hxxp://package2shop.persiangig.com/ 
hxxp://pashang.persiangig.com/ 
hxxp://payam.persiangig.com/ 
hxxp://radmha.persiangig.com/ 
hxxp://sarishenasi.persiangig.com/ 
hxxp://shayanagent.persiangig.com/ 
hxxp://spycho.persiangig.com/ 
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hxxp://tabrix-doc.persiangig.com/ 
hxxp://tourismplanningcenter.persiangig.com/ 
hxxp://z4rbat. persiangig.com/ 
hxxp://a-3is.persiangig.com/ 
hxxp://aali361.persiangig.com/ 
hxxp://aliasp.persiangig.com/ 
hxxp://alireza70707.persiangig.com/ 
hxxp://alirezaedison.persiangig.com/ 
hxxp://amir23.persiangig.com/ 
hxxp://attack.persiangig.com/ 
hxxp://azizpoorian.persiangig.com/ 
hxxp://bardiajoon.persiangig.com/ 
hxxp://bestv.persiangig.com/ 
hxxp://bestxx.persiangig.com/ 
hxxp://bimbim.persiangig.com/ 
hxxp://blacklast.persiangig.com/ 
hxxp://citydesign.persiangig.com/ 
hxxp://compnet91.persiangig.com/ 
hxxp://d3cOder.persiangig.com/ 
hxxp://danitfk.persiangig.com/ 
hxxp://devhamid.persiangig.com/ 
hxxp://ehsankh.persiangig.com/ 
hxxp://erfan3s3.persiangig.com/ 
hxxp://farbodmahini2.persiangig.com/ 
hxxp://farizin.persiangig.com/ 
hxxp://fedora.persiangig.com/ 
hxxp://fixxer.persiangig.com/ 
hxxp://foxworld.persiangig.com/ 
hxxp://fpeykani.persiangig.com/ 
hxxp://ghcmmm.persiangig.com/ 
hxxp://goldhos.persiangig.com/ 
hxxp://hatefkhaledi2.persiangig.com/ 
hxxp://imperial.persiangig.com/ 
hxxp://infology5.persiangig.com/ 
hxxp://inthehalk.persiangig.com/ 
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hxxp://it-tab.persiangig.com/ 
hxxp://iut-team.persiangig.com/ 
hxxp://jahanseir.persiangig.com/ 
hxxp://k1ng-cOnn3ctOr.persiangig.com/ 
hxxp://kingp301.persiangig.com/ 
hxxp://lanjearsz2012.persiangig.com/ 
hxxp://lawless.persiangig.com/ 
hxxp://lifechat.persiangig.com/ 
hxxp://livesos.persiangig.com/ 
hxxp://lordcrazy.persiangig.com/ 
hxxp://lovingyou.persiangig.com/ 
hxxp://majidisaloo.persiangig.com/ 
hxxp://masmasak.persiangig.com/ 
hxxp://mdkhalily.persiangig.com/ 
hxxp://mehrad2.persiangig.com/ 
hxxp://mehransoftware.persiangig.com/ 
hxxp://mohsenashkboos.persiangig.com/ 
hxxp://msjavan.persiangig.com/ 
hxxp://nadijoon.persiangig.com/ 
hxxp://navidparsamehr.persiangig.com/ 
hxxp://pasgroup.persiangig.com/ 
hxxp://pi-pc.persiangig.com/ 
hxxp://planetsecurity.persiangig.com/ 
hxxp://pliskin.persiangig.com/ 
hxxp://ranjbaran.persiangig.com/ 
hxxp://rashidsooroochi.persiangig.com/ 
hxxp://rezmo.persiangig.com/ 
hxxp://saeedkalantari.persiangig.com/ 
hxxp://Saraaras.persiangig.com/ 
hxxp://scooter585.persiangig.com/ 
hxxp://secret63.persiangig.com/ 
hxxp://shaterpouri.persiangig.com/ 
hxxp://shentiaspirit.persiangig.com/ 
hxxp://soyuz.persiangig.com/ 
hxxp://susacity.persiangig.com/ 
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hxxp://sysbooter.persiangig.com/ 
hxxp://taghitaghavi.persiangig.com/ 
hxxp://tajahmadi.persiangig.com/ 
hxxp://tbasoft.persiangig.com/ 
hxxp://tcktc.persiangig.com/ 
hxxp://turkhackers.persiangig.com/ 
hxxp://yazdsrb.persiangig.com/ 
hxxp://yousefj86.persiangig.com/ 
hxxp://yousefli.persiangig.com/ 
hxxp://ysrttu.persiangig.com/ 
hxxp://zeron.persiangig.com/ 
hxxp://afshinvblog.persiangig.com/ 
hxxp://ali64m.persiangig.com/ 
hxxp://alianhmadi85.persiangig.com/ 
hxxp://aliserver.persiangig.com/ 
hxxp://amankhanie.persiangig.com/ 
hxxp://amanzour.persiangig.com/ 
hxxp://anastazia.persiangig.com/ 
hxxp://andayesh.persiangig.com/ 
hxxp://arashakcers.persiangig.com/ 
hxxp://arshad-qeshm-uni.persiangig.com/ 
hxxp://aryari.persiangig.com/ 
hxxp://baner-sazi.persiangig.com/ 
hxxp://bekar.persiangig.com/ 
hxxp://ceh2010.persiangig.com/ 
hxxp://compeng.persiangig.com/ 
hxxp://daneshjooyaneanzali.persiangig.com/ 
hxxp://djnew2010.persiangig.com/ 
hxxp://document.persiangig.com/ 
hxxp://dvbsky.persiangig.com/ 
hxxp://eeten.persiangig.com/ 
hxxp://ersizad.persiangig.com/ 
hxxp://fg123.persiangig.com/ 
hxxp://flower4nobody.persiangig.com/ 


hxxp://gkobile.persiangig.com/ 
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hxxp://grp-bushehr.persiangig.com/ 
hxxp://naamedmohseni.persiangig.com/ 
hxxp://nadadian.persiangig.com/ 
hxxp://hamedeltal.persiangig.com/ 
hxxp://heydari.persiangig.com/ 
hxxp://iceport.persiangig.com/ 
hxxp://iedb-team.persiangig.com/ 
hxxp://it-woman.persiangig.com/ 
hxxp://jamal-ict. persiangig.com/ 
hxxp://jazire-download.persiangig.com/ 
hxxp://jd-t3.persiangig.com/ 
hxxp://jucl1390.persiangig.com/ 
hxxp://kayhan.persiangig.com/ 
hxxp://khajavi0622.persiangig.com/ 
hxxp://khatirdownload.persiangig.com/ 
hxxp://komil88.persiangig.com/ 
hxxp://littledemon.persiangig.com/ 
hxxp://lotfalinia.persiangig.com/ 
hxxp://mahmood-haghighi.persiangig.com/ 
hxxp://maryamsadeghi1372.persiangig.com/ 
hxxp://mechatronics.persiangig.com/ 
hxxp://mehdi2388.persiangig.com/ 
hxxp://mgowdini.persiangig.com/ 
hxxp://mihanzero.persiangig.com/ 
hxxp://milad760.persiangig.com/ 
hxxp://mirzaeicom.persiangig.com/ 
hxxp://mobin66.persiangig.com/ 
hxxp://mohandes-f.persiangig.com/ 
hxxp://mohandes-it.persiangig.com/ 
hxxp://mohsenniknezhad.persiangig.com/ 
hxxp://mokaf.persiangig.com/ 
hxxp://moresamani.persiangig.com/ 
hxxp://naeemafar.persiangig.com/ 
hxxp://netgroup.persiangig.com/ 
hxxp://network-pdf.persiangig.com/ 
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hxxp://nezareh.persiangig.com/ 
hxxp://ostad-mirzaei.persiangig.com/ 
hxxp://p-network.persiangig.com/ 
hxxp://parsaction.persiangig.com/ 
hxxp://pfakhri20.persiangig.com/ 
hxxp://pouyan289.persiangig.com/ 
hxxp://princ3.persiangig.com/ 
hxxp://raminhabibi.persiangig.com/ 
hxxp://restrategy.persiangig.com/ 
hxxp://rn6969.persiangig.com/ 
hxxp://roxaneveil.persiangig.com/ 
hxxp://saeedsoftland.persiangig.com/ 
hxxp://saeidakbari.persiangig.com/ 
hxxp://saeidpiri65.persiangig.com/ 
hxxp://safaeyan.persiangig.com/ 
hxxp://sairan89.persiangig.com/ 
hxxp://sajjadsoftware.persiangig.com/ 


hxxp://salehinbook.persiangig.com/ 


hxxp://salman-moradkhani.persiangig.com/ 


hxxp://tehran-net.persiangig.com/ 


hxxp://yaserbahrami-kntu.persiangig.com/ 


hxxp://yazdonline.persiangig.com/ 
hxxp://yousefij.persiangig.com/ 
hxxp://zxo0003.persiangig.com/ 
hxxp://aassq.persiangig.com/ 
hxxp://abaspur.persiangig.com/ 
hxxp://aciau.persiangig.com/ 
hxxp://alieblice.persiangig.com/ 
hxxp://anafas.persiangig.com/ 
hxxp://avishanrad.persiangig.com/ 
hxxp://azarcomp.persiangig.com/ 
hxxp://azars.persiangig.com/ 
hxxp://bijanfth.persiangig.com/ 
hxxp://dinightdl.persiangig.com/ 


hxxp://doustipress.persiangig.com/ 
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hxxp://dr-linux.persiangig.com/ 
hxxp://e-tejarat.persiangig.com/ 
hxxp://elnaz-share.persiangig.com/ 
hxxp://endlines.persiangig.com/ 
hxxp://explOiters.persiangig.com/ 
hxxp://frameofafsaran.persiangig.com/ 
hxxp://haghighatdoost.persiangig.com/ 
hxxp://hamidaltin.persiangig.com/ 
hxxp://hcv123.persiangig.com/ 
hxxp://hpilevar.persiangig.com/ 
hxxp://hreza.persiangig.com/ 
hxxp://ict-khu.persiangig.com/ 
hxxp://infology4.persiangig.com/ 
hxxp://jesse-avril.persiangig.com/ 
hxxp://jok3r.persiangig.com/ 
hxxp://kitana.persiangig.com/ 
hxxp://kooroshO6.persiangig.com/ 
hxxp://kosarprojeh.persiangig.com/ 
hxxp://loosari.persiangig.com/ 
hxxp://maarek.persiangig.com/ 
hxxp://mgch88.persiangig.com/ 
hxxp://mohsen195.persiangig.com/ 
hxxp://mojyjoon.persiangig.com/ 
hxxp://mousavi21.persiangig.com/ 
hxxp://mr-dc.persiangig.com/ 
hxxp://netinfo. persiangig.com/ 
hxxp://niitnewsfiles. persiangig.com/ 
hxxp://nima-dir.persiangig.com/ 
hxxp://omid1979.persiangig.com/ 
hxxp://pasin.persiangig.com/ 
hxxp://pctec.persiangig.com/ 
hxxp://polsang.persiangig.com/ 
hxxp://poodman91.persiangig.com/ 
hxxp://pypayam.persiangig.com/ 
hxxp://return.persiangig.com/ 
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hxxp://rezashahedi.persiangig.com/ 
hxxp://rhmusic.persiangig.com/ 
hxxp://starl1212ss.persiangig.com/ 
hxxp://strcpy.persiangig.com/ 
hxxp://test07.persiangig.com/ 
hxxp://thatman.persiangig.com/ 
hxxp://tsboys1.persiangig.com/ 
hxxp://vtaghavi68.persiangig.com/ 
hxxp://zxrcz.persiangig.com/ 
hxxp://abizebel.persiangig.com/ 
hxxp://adamantium.persiangig.com/ 
hxxp://alimanam.persiangig.com/ 
hxxp://aliolia82.persiangig.com/ 
hxxp://alma-sanat.persiangig.com/ 
hxxp://aminnajd.persiangig.com/ 
hxxp://azadzanjan.persiangig.com/ 
hxxp://bestjs.persiangig.com/ 
hxxp://bl4ckh4t.persiangig.com/ 
hxxp://bnitir.persiangig.com/ 
hxxp://coolthings.persiangig.com/ 
hxxp://cthulhu.persiangig.com/ 
hxxp://dang3r.persiangig.com/ 
hxxp://danial-y.persiangig.com/ 


hxxp://download98.persiangig.com/ 


hxxp://e-shahmohamadi.persiangig.com/ 


hxxp://ehsan120.persiangig.com/ 
hxxp://eror-include.persiangig.com/ 
hxxp://f4231.persiangig.com/ 
hxxp://hadihadi.persiangig.com/ 
hxxp://namedqcc3.persiangig.com/ 
hxxp://hichkas1.persiangig.com/ 
hxxp://ind33ph3ll.persiangig.com/ 
hxxp://iseeu7.persiangig.com/ 
hxxp://jak0O111.persiangig.com/ 


hxxp://jasoo30.persiangig.com/ 
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hxxp://kitten2.persiangig.com/ 
hxxp://Ihesmaeili.persiangig.com/ 
hxxp://maddad.persiangig.com/ 
hxxp://martyr.persiangig.com/ 
hxxp://md-r00t.persiangig.com/ 
hxxp://momenitiaul.persiangig.com/ 
hxxp://mrgee.persiangig.com/ 
hxxp://net-wOlf.persiangig.com/ 
hxxp://new-fart.persiangig.com/ 
hxxp://onlysyber.persiangig.com/ 
hxxp://pack4u.persiangig.com/ 
hxxp://parssecurity3.persiangig.com/ 
hxxp://pcweb99.persiangig.com/ 
hxxp://perdu.persiangig.com/ 
hxxp://persiankernel.persiangig.com/ 
hxxp://perspolisiha2.persiangig.com/ 
hxxp://phpshells.persiangig.com/ 
hxxp://raliakbari.persiangig.com/ 
hxxp://residenteblis.persiangig.com/ 
hxxp://samiruk.persiangig.com/ 
hxxp://sanaye-en.persiangig.com/ 
hxxp://shirinsol.persiangig.com/ 
hxxp://shop-pack.persiangig.com/ 
hxxp://sinacmd.persiangig.com/ 
hxxp://tayphon.persiangig.com/ 
hxxp://torbat-h2.persiangig.com/ 
hxxp://uploadera.persiangig.com/ 
hxxp://vahidmaani.persiangig.com/ 
hxxp://vhagiloo.persiangig.com/ 
hxxp://w2k8r2.persiangig.com/ 
hxxp://x-spy.persiangig.com/ 
hxxp://yasmlh.persiangig.com/ 
hxxp://zsxfk.persiangig.com/ 
hxxp://abbaslevel2.persiangig.com/ 
hxxp://abbaszoghian.persiangig.com/ 
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hxxp://abolfazlemirzaean.persiangig.com/ 
hxxp://ahmadinia.persiangig.com/ 
hxxp://ahs5500.persiangig.com/ 
hxxp://alirezaamiri.persiangig.com/ 
hxxp://alirezaoroumand.persiangig.com/ 
hxxp://aminmsd.persiangig.com/ 
hxxp://amirbsb.persiangig.com/ 
hxxp://ankiiran.persiangig.com/ 
hxxp://b1386.persiangig.com/ 
hxxp://bijanmoghimi.persiangig.com/ 
hxxp://bolok-13.persiangig.com/ 
hxxp://boxochi.persiangig.com/ 
hxxp://chb23.persiangig.com/ 
hxxp://courses.persiangig.com/ 
hxxp://csharpgroup.persiangig.com/ 
hxxp://dalahoo.persiangig.com/ 
hxxp://darkknight. persiangig.com/ 
hxxp://defcon2.persiangig.com/ 
hxxp://dl8086.persiangig.com/ 
hxxp://dmind.persiangig.com/ 
hxxp://download-mobile.persiangig.com/ 
hxxp://engasht.persiangig.com/ 
hxxp://farshadfaezyrazy.persiangig.com/ 
hxxp://gOld-sOft.persiangig.com/ 
hxxp://golnishan.persiangig.com/ 
hxxp://namedaxman.persiangig.com/ 
hxxp://iuploads.persiangig.com/ 
hxxp://kar1591.persiangig.com/ 
hxxp://kghch.persiangig.com/ 
hxxp://macromediax.persiangig.com/ 
hxxp://mahdisamsami.persiangig.com/ 
hxxp://majidshoae.persiangig.com/ 
hxxp://meshkini522.persiangig.com/ 
hxxp://motefarrej.persiangig.com/ 


hxxp://msafarzadeh.persiangig.com/ 
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hxxp://mzand.persiangig.com/ 
hxxp://nezam01.persiangig.com/ 
hxxp://nilofar12.persiangig.com/ 
hxxp://omidinjector.persiangig.com/ 
hxxp://pajhuohesh.persiangig.com/ 
hxxp://par30site.persiangig.com/ 
hxxp://parsiland.persiangig.com/ 
hxxp://pejvakc.persiangig.com/ 
hxxp://phpbuz.persiangig.com/ 
hxxp://powerfu7.persiangig.com/ 
hxxp://ramstin.persiangig.com/ 
hxxp://sadafedarya38.persiangig.com/ 
hxxp://saghri.persiangig.com/ 
hxxp://shokoli.persiangig.com/ 
hxxp://siyahsefid.persiangig.com/ 
hxxp://softestan.persiangig.com/ 
hxxp://tarrahaneweb.persiangig.com/ 
hxxp://wdddp.persiangig.com/ 
hxxp://zir3da.persiangig.com/ 
hxxp://abbas-virus.persiangig.com/ 
hxxp://afr-computer.persiangig.com/ 
hxxp://albert.persiangig.com/ 
hxxp://alirezabiyal.persiangig.com/ 
hxxp://alvlin.persiangig.com/ 
hxxp://amirhossein021.persiangig.com/ 
hxxp://arash-soft.persiangig.com/ 
hxxp://ashkanan3.persiangig.com/ 
hxxp://bia2bestfile.persiangig.com/ 
hxxp://civilexp.persiangig.com/ 
hxxp://cybersaboteur.persiangig.com/ 
hxxp://dialup-download.persiangig.com/ 
hxxp://dl4-downloadfa.persiangig.com/ 
hxxp://downloadestan5.persiangig.com/ 
hxxp://e3mail.persiangig.com/ 
hxxp://ekrami01.persiangig.com/ 
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hxxp://esmaeilpoor.persiangig.com/ 
hxxp://esshop.persiangig.com/ 
hxxp://faraz4u.persiangig.com/ 
hxxp://fatalking.persiangig.com/ 
hxxp://gOld-soft.persiangig.com/ 
hxxp://gha3dak.persiangig.com/ 
hxxp://gold-sOft.persiangig.com/ 
hxxp://gpod1.persiangig.com/ 
hxxp://named-qcc.persiangig.com/ 
hxxp://namedanno.persiangig.com/ 
hxxp://namedweb.persiangig.com/ 
hxxp://hamix2x.persiangig.com/ 
hxxp://notweb24.persiangig.com/ 


hxxp://hunterprogs.persiangig.com/ 


hxxp://impostor-76171.persiangig.com/ 


hxxp://iran30download.persiangig.com/ 


hxxp://iranmahsool.persiangig.com/ 
hxxp://jovss.persiangig.com/ 
hxxp://joker12.persiangig.com/ 
hxxp://kapakha3.persiangig.com/ 
hxxp://keylogger.persiangig.com/ 
hxxp://kiandew.persiangig.com/ 
hxxp://kifabi.persiangig.com/ 
hxxp://lord-pc.persiangig.com/ 
hxxp://M1998.persiangig.com/ 
hxxp://mahdil0.persiangig.com/ 
hxxp://mammadcpu.persiangig.com/ 
hxxp://masterjoint.persiangig.com/ 
hxxp://mazaghine.persiangig.com/ 
hxxp://mehd1.persiangig.com/ 
hxxp://metal-baz.persiangig.com/ 
hxxp://mhm5000.persiangig.com/ 
hxxp://mrpayne.persiangig.com/ 
hxxp://narmafzar28.persiangig.com/ 


hxxp://net-work.persiangig.com/ 
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hxxp://noktehaa.persiangig.com/ 
hxxp://onlykdk.persiangig.com/ 
hxxp://p30cloob.persiangig.com/ 
hxxp://persiantnt.persiangig.com/ 
hxxp://ramin-rock.persiangig.com/ 
hxxp://rexona-dl.persiangig.com/ 
hxxp://reza-eblicen.persiangig.com/ 
hxxp://rommy.persiangig.com/ 
hxxp://saman034.persiangig.com/ 
hxxp://satanic.persiangig.com/ 
hxxp://savitr.persiangig.com/ 
hxxp://sevdaboy.persiangig.com/ 
hxxp://shamal.persiangig.com/ 
hxxp://shansi-saghy.persiangig.com/ 
hxxp://spyftp.persiangig.com/ 
hxxp://tanhastrife.persiangig.com/ 
hxxp://upload-ekrami.persiangig.com/ 
hxxp://upload4u.persiangig.com/ 
hxxp://uploadh.persiangig.com/ 
hxxp://uploadr.persiangig.com/ 
hxxp://vomahdi2009.persiangig.com/ 
hxxp://world-infotech. persiangig.com/ 
hxxp://wsoft.persiangig.com/ 
hxxp://xpl7a.persiangig.com/ 
hxxp://yahoohelper.persiangig.com/ 
hxxp://zebel-khan.persiangig.com/ 
hxxp://zeussoft.persiangig.com/ 
hxxp://zsoft.persiangig.com/ 
hxxp://alex1.persiangig.com/ 
hxxp://arashgaleri.persiangig.com/ 
hxxp://ardavanpc.persiangig.com/ 
hxxp://behraduk.persiangig.com/ 
hxxp://computerforensics.persiangig.com/ 
hxxp://computerplus.persiangig.com/ 
hxxp://dl1-security-network.persiangig.com/ 
1070 


hxxp://echarge24.persiangig.com/ 
hxxp://ejavanmard.persiangig.com/ 
hxxp://elinamordadi.persiangig.com/ 
hxxp://esf-shop.persiangig.com/ 
hxxp://eshterak2.persiangig.com/ 
hxxp://groupsyahoo.persiangig.com/ 
hxxp://hfasanpc.persiangig.com/ 
hxxp://idrecover.persiangig.com/ 
hxxp://iran-haraj.persiangig.com/ 
hxxp://jaefari.persiangig.com/ 
hxxp://k-sazwari.persiangig.com/ 
hxxp://kabehentezar.persiangig.com/ 
hxxp://karara.persiangig.com/ 
hxxp://lartik.persiangig.com/ 
hxxp://mac-dl-com.persiangig.com/ 
hxxp://mahidown.persiangig.com/ 
hxxp://mansourlotfi.persiangig.com/ 
hxxp://mayanet.persiangig.com/ 
hxxp://mehdipendar.persiangig.com/ 
hxxp://noofoz.persiangig.com/ 
hxxp://panjsaher5.persiangig.com/ 
hxxp://pishgooyan.persiangig.com/ 
hxxp://riazi51.persiangig.com/ 
hxxp://saeedmaster.persiangig.com/ 
hxxp://sagheb.persiangig.com/ 
hxxp://shadmehrdj.persiangig.com/ 
hxxp://sheller2.persiangig.com/ 
hxxp://takahang.persiangig.com/ 
hxxp://alkanpc.persiangig.com/ 
hxxp://amirabar.persiangig.com/ 
hxxp://ao255.persiangig.com/ 
hxxp://arakmassage.persiangig.com/ 
hxxp://bb3h1.persiangig.com/ 
hxxp://darklordofthedestiny.persiangig.com/ 
hxxp://dl-p300n-2.persiangig.com/ 
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hxxp://e2ma3n.persiangig.com/ 
hxxp://eli22.persiangig.com/ 
hxxp://ervina.persiangig.com/ 
hxxp://farshidfallahi.persiangig.com/ 
hxxp://farzadnanejan.persiangig.com/ 
hxxp://files.persiangig.com/ 
hxxp://files1.persiangig.com/ 
hxxp://fishingteam.persiangig.com/ 
hxxp://freevlife.persiangig.com/ 
hxxp://goldon.persiangig.com/ 
hxxp://hspawn.persiangig.com/ 
hxxp://iii1992iii.persiangig.com/ 
hxxp://kiomarsss.persiangig.com/ 
hxxp://l-lacker.persiangig.com/ 
hxxp://lesolai.persiangig.com/ 
hxxp://liplipok.persiangig.com/ 
hxxp://mOriiii.persiangig.com/ 
hxxp://mOtrix.persiangig.com/ 
hxxp://magic4.persiangig.com/ 
hxxp://majidnezam.persiangig.com/ 
hxxp://mmv1991.persiangig.com/ 
hxxp://mojt3b3.persiangig.com/ 
hxxp://mormoroth.persiangig.com/ 
hxxp://nbc-ashiyane.persiangig.com/ 
hxxp://ncoder.persiangig.com/ 
hxxp://nethunter. persiangig.com/ 
hxxp://netqq.persiangig.com/ 
hxxp://nimakarimi.persiangig.com/ 
hxxp://omidplus.persiangig.com/ 
hxxp://pezhmanmax2002.persiangig.com/ 
hxxp://programmers.persiangig.com/ 
hxxp://pzr23.persiangig.com/ 
hxxp://reign.persiangig.com/ 
hxxp://root3r-h3ll.persiangig.com/ 
hxxp://root3r.persiangig.com/ 
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hxxp://ruin3r-ashiyane.persiangig.com/ 
hxxp://saber-net.persiangig.com/ 
hxxp://saeed006.persiangig.com/ 
hxxp://sevom.persiangig.com/ 
hxxp://shabangahweb.persiangig.com/ 
hxxp://sina-serverl.persiangig.com/ 
hxxp://tntboy-001.persiangig.com/ 
hxxp://toopor-ir.persiangig.com/ 
hxxp://ven0oOs.persiangig.com/ 
hxxp://yahoo-bax.persiangig.com/ 
hxxp://air-siavash.persiangig.com/ 
hxxp://alibarzegar.persiangig.com/ 
hxxp://alimohajer.persiangig.com/ 
hxxp://arsalan100.persiangig.com/ 
hxxp://arshadguilan.persiangig.com/ 
hxxp://bossrasoul.persiangig.com/ 
hxxp://daramad14.persiangig.com/ 
hxxp://dinhac.persiangig.com/ 
hxxp://harrypotter722.persiangig.com/ 
hxxp://hh13570-sat.persiangig.com/ 
hxxp://karimzadeh.persiangig.com/ 
hxxp://kingofeagle.persiangig.com/ 
hxxp://metal200626.persiangig.com/ 
hxxp://miladgolnan.persiangig.com/ 
hxxp://milaneiran.persiangig.com/ 
hxxp://moejezat.persiangig.com/ 
hxxp://mr00798.persiangig.com/ 
hxxp://nn555.persiangig.com/ 
hxxp://p30base.persiangig.com/ 
hxxp://parsiblog.persiangig.com/ 
hxxp://playstation3.persiangig.com/ 
hxxp://shaji.persiangig.com/ 

Happy Technical Collection. 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEi1EiNb6K3r3B1cULIPNM6M-xRAgKs6vUbVj J8jNMotxqia_ 
XPcUCJRBiFNNU27nUdg1iXLsxRcdzp8LId1- j2cZhh8QpWIuHhH8v2- 
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1.6.4 


A Compilation of Bulletproof Hosting Provider Domains (2023-08-13 11:27) 


[1] 


THIS DOMAIN HAS BEEN SEIZED 


' ay thes Federal Bureau of investigation and Internal Revenue service Griminal Investigation 
pas: Part cit 3 eoordinated lawentorcement action taken against) 


The action has been taken in coordination with 
the United States Attorney's Office for the Middle District of Florida and 
the Computer Crime and Intellectual Property Section of the Department of Justice 
With substantial assistance provided by Prokuratura Regionaina w Katowicach 
and Centralne Biuro 2walczania Cyberpfzestepczasci 2arzad Ww Krakowie. 


In need of a fresh and relevant bulletproof hosting provider domain list for research purposes? 


Check out the following list of domains which | compiled today and decided to share with 
everyone reading my blog. 


Sample bulletproof hosting provider domains include: 


hxxp://1984hosting.com 
hxxp://2X4.ru 
hxxp://2sync.co 


hxxp://3nt.com 


hxxp://NovoGara.com 


hxxp://abusehosting.ru 


hxxp://admintek.net 


hxxp://advania.com 


hxxp://afranet.com 


hxxp://agava.ru 


hxxp://albahost.net 


hxxp://alexhost.com 
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hxxp://altushost.com 
hxxp://anders.ru 
hxxp://anonymoushosting.in 
hxxp://antiddos.biz 
hxxp://area6.ru 
hxxp://artmotion.eu 
hxxp://asiapacific-it.com 
hxxp://asiapacifichosting.com 
hxxp://atlax.com 
hxxp://availo.se 
hxxp://avk-com.ru 
hxxp://bacloud.com 
hxxp://bahnhof.net 
hxxp://balkanvps.com 
hxxp://beotel.net 
hxxp://berihoster.ru 
hxxp://besthosting.ua 
hxxp://blazingfast.io 
hxxp://blueangelhost.com 
hxxp://borneo.kg 
hxxp://bulletproof-web.ru 
hxxp://bullhost.co 
hxxp://ccihosting.com 
hxxp://cinipac.com 
hxxp://citynethost.com 
hxxp://cloud.volia.com 
hxxp://cloudlite.ru 
hxxp://colocall.net 
hxxp://comsats.net.pk 
hxxp://continent8.com 
hxxp://crservers.com 
hxxp://ctyun.cn 
hxxp://cubexsweatherly.com 
hxxp://curacaowebhosting.com 


hxxp://cyberbunker.com 
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hxxp://cyberfuel.com 
hxxp://datacenter.ir 
hxxp://datahouse.ru 
hxxp://dataplugs.com 
hxxp://dedicado.com.uy 
hxxp://deltahost.com 
hxxp://deltalis.com 
hxxp://deltasystem.cl 
hxxp://dis.telecom.kz 
hxxp://dmzhost.c 
hxxp://doclerweb.com 
hxxp://dreamwebhosting.net 
hxxp://ecatel.co.uk 
hxxp://eccsolutions.net 
hxxp://ecodissident.net 
hxxp://ekvia.com 
hxxp://elkupi.com 
hxxp://elvsoft.com 
hxxp://en.datasource.ch 
hxxp://en.hostsolutions.ro 
hxxp://en.ukrtelecom.ua 
hxxp://en.uplink.hu 
hxxp://eng.deninet.net 
hxxp://eodatacenter.com 
hxxp://eranet.com 
hxxp://eserver.ru 
hxxp://evoluso.com 
hxxp://exmasters.com 
hxxp://fastvds.ru 
hxxp://finalhosting.cz 
hxxp://firstbyte.ru 
hxxp://firstvds.ru 
hxxp://flokinet.is 
hxxp://freehost.com.ua 
hxxp://galkahost.com 
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hxxp://geekhost.pro 
hxxp://gemenii.ro 
hxxp://glesys.com 
hxxp://global.ba 
hxxp://globatel.org 
hxxp://gmhost.hosting 
hxxp://goodnet.com.ua 
hxxp://grandhost.cc 
hxxp://habangnet.com 
hxxp://hc.ru 
hxxp://heberjahiz.com 
hxxp://hidemyhost.com 
hxxp://hktechnology.com 
hxxp://host.al 
hxxp://hostalot.ru 
hxxp://hoster.ru 
hxxp://hosthink.net 
hxxp://hosting.nic.ru 
hxxp://hosting.reg.com 


hxxp://hosting.tel.ru 


hxxp://hosting.tongacable.net 


hxxp://hosting.turk.net 
hxxp://hosting.ua 
hxxp://hostingserve.rs 
hxxp://hostkey.com 
hxxp://hostname.cl 
hxxp://hostoweb.com 
hxxp://hostparatuvida.com 
hxxp://hostsailor.com 
hxxp://hts.ru 
hxxp://hub.org 
hxxp://icyevolution.com 
hxxp://idhost.kz 
hxxp://ihc.ru 
hxxp://ihor.ru 
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hxxp://infiumhost.com 
hxxp://infobox.ru 
hxxp://infomaniak.ch 
hxxp://innovahosting.net 
hxxp://insacom.cl 
hxxp://internetport.com 
hxxp://internetsolutions.hk 
hxxp://iprosrv.com 
hxxp://ironservers.cl 
hxxp://isocompania.com 
hxxp://ispserver.com 
hxxp://ititch.com 
hxxp://ithdc.com 
hxxp://itools.mn 
hxxp://ixam-hosting.com 
hxxp://justhost.in.ua 
hxxp://katzglobal.com 
hxxp://knownsrv.com 
hxxp://koddos.com 
hxxp://kowloonhosting.com 
hxxp://kras.host 
hxxp://kriweb.com 
hxxp://laceibanetsociety.com 
hxxp://lankapartnerhost.com 
hxxp://latinoserver.com 
hxxp://Ifait.com 
hxxp://libertyvps.net 
hxxp://libyanspider.com 
hxxp://licosys.com 
hxxp://linkdatacenter.net 
hxxp://localhost.tn 
hxxp://lolekhosted.net 
hxxp://Itt. ly 
hxxp://lunarvps.com 
hxxp://lunarvps.comorangewebsite.com 
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hxxp://m247.roen 
hxxp://magicnet.md 
hxxp://masterhost.ru 
hxxp://mcloud.rs 
hxxp://melbicom.net 
hxxp://memvds.ru 
hxxp://mikrovps.com 
hxxp://mirohost.net 
hxxp://mtel.ba 
hxxp://mycloud.by 
hxxp://nashirnet.net 
hxxp://natro.com 
hxxp://neoserver.ru 
hxxp://netassist.ua 
hxxp://netbrella.net 
hxxp://netengi.com 


hxxp://netplace.ru 


hxxp://networksdelmanana.com 


hxxp://nexlinx.net.pk 
hxxp://nexus.pk 
hxxp://nidahost.com 
hxxp://nine.ch 
hxxp://ninet.rs 
hxxp://nonamehosts.com 
hxxp://nplusone.ma 
hxxp://nsc.ba 
hxxp://oblaci.rs 
hxxp://offshorededi.com 
hxxp://offshoreracks.com 
hxxp://ohp.ua 
hxxp://ok.is 
hxxp://online.tm 
hxxp://orangewebsite.com 
hxxp://ouriran.com 


hxxp://overleaf.com 
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hxxp://pachosting.hk 
hxxp://panamaserver.com 
hxxp://parsonline.com 
hxxp://parspack.com 
hxxp://pavietnam.vn 
hxxp://pin.se 
hxxp://pirateshosting.net 
hxxp://planetahost.ru 
hxxp://plus.hr 
hxxp://pndc.ir 
hxxp://portlane.com 
hxxp://powerhost.cl 
hxxp://privatelayer.com 
hxxp://pro-managed.com 
hxxp://proen.co 
hxxp://proen.co.CARDING FORUM 
hxxp://proen.co.th 
hxxp://profivps.hu 
hxxp://prq.se 
hxxp://ps.kz 
hxxp://ptclcloud.com.pk 
hxxp://pttrs.net 
hxxp://pw-service.com 
hxxp://qsscloud.ba 
hxxp://rackend.com 
hxxp://racklodge.com 
hxxp://racknation.cr 
hxxp://radore.com 
hxxp://rapidcompute.com 
hxxp://rayadatacenter.com 
hxxp://renter.ru 
hxxp://rockhoster.com 
hxxp://ru-tld.ruen 
hxxp://rusonyx.ru 
hxxp://rx-name.ua 
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hxxp://sadecehosting.com 
hxxp://securehost.com 
hxxp://selectel.com 
hxxp://semele.com.tr 
hxxp://seohosting.com.tr 
hxxp://server.ua 
hxxp://serverastra.com 
hxxp://serverhk.org 
hxxp://serverhosting.my 
hxxp://serveria.com 
hxxp://servidores.gamerlive.cl 
hxxp://shinjiru.com 
hxxp://simplecloud.ru 
hxxp://sinohosting.net 
hxxp://smart-hosting.ro 
hxxp://solarcom.ch 
hxxp://sologigabit.com 
hxxp://space.kz 
hxxp://starrydns.net 
hxxp://sunnyvision.com 
hxxp://superhosting.net 
hxxp://swedehost.net 
hxxp://swedendedicated.com 
hxxp://synwebhost.org 
hxxp://syt.com 
hxxp://t4.cr 
hxxp://takewyn.com 
hxxp://tchile.com 
hxxp://tehnodom.com 
hxxp://tele-asia.net 
hxxp://teleklik.ba 
hxxp://thnic.co 
hxxp://thnic.co. CARDING FORUM 
hxxp://thnic.co.th 
hxxp://thost.ru 
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hxxp://tilaa.com 
hxxp://time4vps.eu 
hxxp://timeweb.com 
hxxp://tomtel.ru 
hxxp://tophost.mden 
hxxp://trabia.com 
hxxp://trvps.net 
hxxp://tucha.ua 
hxxp://uanode.net 
hxxp://uar.net 
hxxp://udasha.com 
hxxp://ukraine.com.ua 
hxxp://ukrdc.net 
hxxp://ukrnames.com 
hxxp://ultratechhost.com 
hxxp://underhost.com 
hxxp://unit-is.com 
hxxp://uniteddc.net.ua 
hxxp://urdn.com.ua 
hxxp://valuehost.ru 
hxxp://vds64.com 
hxxp://vdsinside.com 
hxxp://vhoster.net 
hxxp://victoriagroup.me 
hxxp://vinahost.vn 
hxxp://vinastar.net 
hxxp://virtono.com 
hxxp://virtualpark.hu 
hxxp://vit.com.tr 
hxxp://voxility.com 
hxxp://vps.ag 
hxxp://vpsbg.eu 
hxxp://vpsgod.com 
hxxp://vscale.io 
hxxp://vstoike.ru 
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hxxp://warez-host.com 
hxxp://wavecom.ee 
hxxp://web-server.eu 
hxxp://webcare360.com 
hxxp://webhost.tn 
hxxp://webonic.hu 
hxxp://webservices.dz 
hxxp://webuzo.net 
hxxp://weservit.nl 
hxxp://wrzhost.com 
hxxp://xenyohosting.com 
hxxp://xeonbd.com 
hxxp://xethost.com 
hxxp://xhostfire.com 
hxxp://xservers.ro 
hxxp://yourserver.se 
hxxp://zgh.cl 
hxxp://zomro.com 


Happy hunting. 


1. https: //blogger.googleusercontent .com/img/b/R29vZ2x1/AVvXsEh1M1zU23GyZuuaYyR-51Kegn-MZule8fUJIdQs7pJelf Aq: 
980sof6kvX0aBqHUL7V-zg0AeGB1s9P6a50_GLOSKUbVIKp0_j0440 


1.6.5 Exposing a Currently Active Personally Identifiable Cybercriminals 


XMPP/Jabber Account IDs Portfolio (2023-08-20 21:37) 


[1] 
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<parent> Darkmoney lHonker ShadowMarket 


Wana DarkWeb LinkFeed SkyFraud 
365Exe DomenForum Linuxac.org Spyhackerz 
41S9eater Eviloctal Master-X Svuit.vn 
4HatDay Exelab MasterWebs Szenebox 
aHack Forum-UINSell MaulTalk Szuwi 
Allyyosh Forum Zloy bz Mmpg.ru Tenebris 
Antichat ru ForumSape = Mr1t-11mr7alm.org TheBot 
ArmadaBoard ForumSEG Nullnoss org Toolbabase se 
BigFozzy Free-hack pay-per-installorg  §‘ TotaiBlackhat 
BlackhatWorld ghostmarket net PhreakerPro Turkhackteam 
BPCForum Gla.vn Piratebuhta pw Vsehobby 
Cardvilla GoFuckBiz ProCrd Webmasters ru 
Chf gofuckbiz.com ProLagic Whitehatyn 
CNHonker H4kurd.com Promarket WW H-Club 
CNSec Hack-Port ProxyBase www.opense.ws 
Crack-Forum Hackersoft scamwarners Xakep.bg 
Cracked.to Hackingboard SEOCafe Xakepok 
Cyberizm Hackings SEOForum Zismo 
Darkmarket Ia iFud 


Folks, 


I’ve been recently digging deep into the ever evolving cybercrime ecosystem doing research 
and trying to supply as much personally identifiable information on the bad guys in the form of 
personally identifiable email address accounts including XMPP/Jabber account IDs where the 
ultimate goal would be to properly assist everyone on their way to properly do their research 
including the U.S Intelligence Community and U.S Law Enforcement on its way to properly 
track down and monitor the individuals behind these campaigns. 


In this post I’ll share with everyone a recently processed portfolio of personally identifiable 
XMPP/Jabber account IDs with the idea to assist everyone on their way to properly do their 
research including to assist the U.S Intelligence Community and U.S Law Enforcement on its 
way to properly track down and monitor these individuals. 


Happy research. 

Sample personally identifiable cybercriminals XMPP/Jabber account IDs include: 
fastchk@dlab.im 

fastchk@dukgo.com 

fastchk@xmpp.su 

seotest@swissjabber.ch 

coding@xmpp.jp 

j _sparrow@business.cc 

ksx@jabber.dk 
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egeg@Onlline.at 
support@1vpns.com 
firstvpn@jabber.cz 
synack@xjabber.org 
jedecapua@fbi.gov 
mvanderbunt@fbi.gov 


Alexander.Gutwin@europol.europa.eu 
Catarina.Nunes-Ladeira@europol.europa.eu 
aalmarri@dubaipolice.gov.ae 


k.alhosani@dubaipolice.gov.ae 


dosx@exploit.im 
cityofgod@exploit.im 
synack@sj.ms 
ia@exploit.im 
topdos@verified.pm 
moviestar@jabber.de 
looklingtobuy@xmpp.jp 
dr32@exploit.im 


aril0Okrat@jabber.mipt.ru 


markus123@jabber.cz 
vetman3@blah.im 
marquis@wiuwiu.de 
bOrman@xmpp.jp 
synack@dlab.im 
synack2@dukgo.com 
synack@xmpp.su 
topdos@xmpp.jp 
maestro@jabber.at 
chopin@exploit.im 
chop@none.su 
web47@xabber.de 
m4doff@sj.ms 
asuwant@exploit.im 
asuwant@jabber.ccc.de 


dibua@thesecure. biz 
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sales@vip-support.org 
support@vip-support.org 
starik@thesecure.biz 
valek.dennikov@gmail.com 
fizot@mail.ru 
xtexcounter@bk.ru 
wm.lancelot@gmail.com 
maravanio@gmail.com 
mserver@mail.ru 
game@gameprom.com 
ahmed _yurlanov1988@protonmail.com 
kurganlab@mail.ru 
koska@jabber.ccc.de 
polobandit@xmpp.jp 
supahelp@jaim.at 
finedumps.com@exploit.im 
trackz@mpro.la 
trackz@pkey.in 
dpp@exploit.im 
d4s@jabber.fr 
roxas@swissjabber.ch 
planet9@sj.ms 
g3mz@exploit.im 
A.M.1.G.0.S@exploit.im 
p-x@hacker.im 
wermonter@neko.im 
hitro@roteshield.ru 
jasha@zauris.ru 
onkelzzz@pandion.im 
none _1@xmpp.jp 
asuwant@mfclub.ws 
prof777@xmpp.jp 
no.like.other@jabber.cd 
qir@codingteam.net 
greystone@jabber.cn 
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success@xmpp.pro 
acsyS@xmpp.jp 
shopbuyshop@sj.ms 
ps2k20@jabber.ru 
swarmshop@verified.pm 
bcd@europe.com 
worldofproxy@inbox.ru 
steryk@mail.ru 
flycracker@jabba.in 
serg@kaddafi.me 
sandman@jab.im 
keeloq@crypto.rub.de 
platplus@tormail.net 
bridges@torproject.org 
phantominfo@xanon.net 
soupnazi@efnet.ru 
i.am@padonaque. info 
Leroy2004@mail.ru 
Kup _land@mail.ru 
mater.gang@jabba.biz 
pro.stuffer@exploit.im 
exroot@exploit.im 
night.walker@xmpp.jp 
master.zu@mfclub.ws 
master.zu@exploit.im 
aventus@jabba.biz 
aventus@xmpp.jp 
epicman@thesecure.biz 
fingerlink@exploit.im 
well.good@thesecure. biz 
pete777@mail.ru 
cps@calgarypolice.ca 
desertmack@mailvault.com 
chinabigl1@gmail.com 
Gangass@exploit.im 
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gangass@jabber.at 
kjlj@adjdjjg.com 

fidel _orders@yahoo.com 
kk@prozvon.us 
rdm-yandex@nnm.ru 
plgs@xmpp.jp 
viking@OnllLne.at 
888300@exploit.im 
vvMvv@exploit.im 
kkk@jid.pl 
bruj@jabber.minus273.org 
support@ljabber.com 
admin@1ljabber.com 
pferguson@cizmicconsulting.com 
2002@chatme.im 

negro _albino@jabber.ru 
golden _triangle@xmpp.jp 
masonhppy@gmail.com 
universe@sj.ms 
dds@xmpp.jp 
d02@xmpp.jp 
consilium@sj.ms 
forename.lastname@cl.cam.ac.uk 
ika@jabber.cx 
elcondor@thesecure. biz 
scans@vOid.cc 
garry.wu@safe-mail.net 
0121@sj.ms 
stas_vi@mail.ru 
s3x@neko.im 
rubensamvelich@yahoo.com 
boookscafe@yahoo.com 
you@yourmail.com 
Server2009@SMB3.local 
Beny.Krick@jabber.in 
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dsp559@hotmail.com 
andres555@rambler.ru 
vrublevsky@chronopay.com 
p.vrublevsky@chronopay.com 
red@mail-eye.com 
myusername@mywebsite.com 
mnsclec@gmail.com 
mick@sensorynetworks.com 
icq _uin@gqip.ru 
info@kaspersky.com 
forum@kaspersky.com 
webmaster@kaspersky.com 
icamis@carderplanet.cc 
contact@privacyprotect.org 
tiny@webmoney.ru 
admin@gmail.com 
support@igatele.com.tw 
kevinchu@igatele.com.tw 
service@xinonet.cn 
support@echonet.tw 
noc@cexlink.cn 
wang@xterra.tw 
tsai@isInet.cn 
noc@twinnet.tw 
no.valid.email@worldnic.com 
chan@twinnet.tw 
lee.eric@echonet.tw 
d0a9bd362531bfc787826bfe5fb75b47 @todaynic.biz 
j.yang@cexlink.cn 
kim@xinonet.cn 
plastics@webmoney.ru 
val@carderplanet.cc 
qip@carderplanet.cc 
kk@carderplanet.cc 
tt@carderplanet.cc 
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fj/10@carderplanet.cc 
caesar@carderplanet.cc 
powerseller@carderplanet.cc 
rdmya@carderplanet.cc 
dohlii@carderplanet.cc 
complain@carderplanet.cc 
afelio@carderplanet.cc 
mike@carderplanet.cc 
ultimatum@carderplanet.cc 
ika@jabber.sg 
pass@xxx.com 
bre@headcounter.org 
godtimees@jabber.org 
parrotard@jabber.org 
komproll@thesecure. biz 
razin@carderplanet.cc 
sccss@xmpp.pro 
irzhikOO7@limun.org 
vOid _cc@hotmail.com 
vOid@jabber.cn 
dongle0101@yahoo.com 
nrew89@gmail.com 
andrey89@nextmail.ru 
nestle@neko.im 
mazafaka@libero.it 
777flyck777@gmail.com 
gugusik@thesecure.biz 
partyzan@thesecure. biz 
cr4dshO@gmail.com 

anti xabar@mail.ru 
p@safenrgy.com 
box4qip@mail.ru 
nolme@swissjabber.ch 
barlog@Online.at 
karabas@jabbim.com 
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supportstyle@jabbim.com 
hkn@novonordisk.com 
sal@jabba.in 
dominium@thesecure. biz 
ika@jabba.in 
ika@thesecure. biz 
dearadmin@jabber.org 
sal@jabber.sg 
privatenet@jabber.cx 
billpaid@xmpp.jp 
marshm3llo@exploit.im 
mak@mazafaka. info 
brainjabber@default.rs 
cart3r@shangryla.net 
solid s@carderplanet.cc 
k3@pbank.com.ua 
4docent@gmail.com 
user@example.org 
leeloodallas@jabber.org 
brando@jabber.no 
fly@darklife.ws 
narcause@swissjabber.ch 
best bunnn@hotmail.com 
robinbobin@jabber.cn 
everything@jabber.ms 


pipl-partners@jabber.xakep.kz 


janus@haliluya.biz 
rs-socks@thesecure. biz 
kentyay@yahoo.com 
hunterirby@yahoo.com 
Shakil999@yahoo.com 
dr _uploaderl@mail.ru 
dr _uploader@yahoo.com 
cyberalibi@gmail.com 


asadcp@mail.ru 
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sd@fucksheep.org 

x86 64nsd@fucksheep.org 
northpole@live.com 
u@yahoo.co.uk 
ika@spam.coop 
slevin@europe.com 
alexmussel@aol.com 
novashogun18@live.com 
satoshi@gmx.de 
whitephoenix@mail.ru 
alesiayglesias@yahoo.com 
crazzzyhorse79@aol.com 
icamis@4host.info 
judidadada@btinternet.com 
spdteam@tom.com 
conf@infosystem.ru 
syrian.es.sy@gmail.com 
sea@sea.sy 
sal@thesecure.biz 
jrandom@example.com 
mOudi@9.cn 

Flouf@live.fr 
support@webmoney.ru 
1234@ftp.narod.ru 
hOmini@mail.ru 
mavook@gmail.com 
troxel@yandex.ru 
arxwolf2010@mail.ru 
certificate@trustcenter.de 
premium-server@thawte.com 
psyche.evolution@gmail.com 
Eagle@diginf.ru 
ronnich@gmail.com 
nenastnyj@gmail.com 
volodyja@gmail.com 
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vlaman@gmail.com 
transitaircargoinc@gmail.com 
bashorg@talking.cc 
xtexgroup@gmail.com 
Krotreal@mobsoft.com 
andrew@elitum.com 
redeye@jabber.no 
andy@imjabber.com 
asdas12334@mail.ru 
andy@im.despmedia.com 
shaman@gateline.net 
dgc@gateline.net 
WHanlinLittleton@gmail.com 
cwilson2020@comcast.net 
flynavy@hotmail.com 
Mangerfredmanger@gmail.com 
capellau1968.test@yahoo.it 
pr@cray.com 
tcouch@microsoft.com 
ir@cray.com 

fc@mail-eye.com 
hO7@interia.pl 
service@youtube.com 
silentbob@safe-mail.net 
cuneiform@cognitive.ru 
maestro@jabber.org 
eims@ic.fbi.gov 
onenote@exploit.im 
maestro@jabbber.at 
USADC.VIS.USVTMCCormick@usdoj.gov 
reshenie _problem@yahoo.com 
agressor@evilium.com 
666@agressor.cc 
juliethotel@hotmail.com 


support@dropping-service.biz 
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admin@NetworkSolutionsmsx.co.uk 
sad@aol.com 

asf@msn.com 
gfhgf@yahoo.com 
kk@sgarrist.net 
myname@mymail.com 
support@synebs.com 
mih@colt.ilogic.ru 
forum@pont.ru 
agslab@gmail.com 
cgi-mailer-bounces-90434292@kundenserver.de 
E1CcQXv-0002Wz-00@mrvnet.kundenserver.de 
abuse@kundenserver.de 
clansman@pisem.net 
chrischildsLO@btinternet.com 
kirsty314@hotmail.com 
order@info-dumps.com 
peacockpower@excite.com 
flexip@mail.ru 
burkan02@hotmail.com 
admin@go.org.ua 
kavkey@mail.ru 
XXX@xXxXxX.com 
zadnical2@hotmail.com 
zadnical2@aol.com 
zadnical2@yahoo.com 
Rabotalrubl@mail.ru 
jag@jabba.biz 
salinemotors@safe-mail.net 
at@fsb-rf.ru 
drondron@safe-mail.net 
abase@hotmail.com 
aesop@hotmail.com 
ail@hotmail.com 
ape@hotmail.com 
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appear@hotmail.com 
athens@hotmail.com 
bare@hotmail.com 
bays@hotmail.com 
being@hotmail.com 
belt@hotmail.com 
bills@hotmail.com 
blurs@hotmail.com 
bosom@hotmail.com 
chafe@hotmail.com 
chimp@hotmail.com 
closet@hotmail.com 
cobble@hotmail.com 
coda@hotmail.com 
coup@hotmail.com 
cram@hotmail.com 
decor@hotmail.com 
dee@hotmail.com 
diets@hotmail.com 
doily@hotmail.com 
douse@hotmail.com 
drank@hotmail.com 
eagle@hotmail.com 
edges@hotmail.com 
extent@hotmail.com 
feel@hotmail.com 
fetal@hotmail.com 
focus@hotmail.com 
foxy@hotmail.com 
fully@hotmail.com 
gamut@hotmail.com 
globe@hotmail.com 
glum@hotmail.com 
gmt@hotmail.com 


guard@hotmail.com 
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heath@hotmail.com 
hints@hotmail.com 
hired@hotmail.com 
hydra@hotmail.com 
ida@hotmail.com 
incest@hotmail.com 
inner@hotmail.com 
john@hotmail.com 
joshua@hotmail.com 
lava@hotmail.com 
lawn@hotmail.com 
lax@hotmail.com 
lids@hotmail.com 
lime@hotmail.com 
loll@hotmail.com 
loved@hotmail.com 
mary@hotmail.com 
mats@hotmail.com 
meal@hotmail.com 
meek@hotmail.com 
might@hotmail.com 
mno@hotmail.com 
momma@hotmail.com 
mommy@hotmail.com 
mope@hotmail.com 
mum@hotmail.com 
nba@hotmail.com 
nil@hotmail.com 
oral@hotmail.com 
oust@hotmail.com 
owe@hotmail.com 
path@hotmail.com 
paula@hotmail.com 
pen@hotmail.com 
plead@hotmail.com 
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plump@hotmail.com 
poll@hotmail.com 
pupil@hotmail.com 
rash@hotmail.com 
rep@hotmail.com 
review@hotmail.com 
rims@hotmail.com 
roads@hotmail.com 
roost@hotmail.com 
ruins@hotmail.com 
salami@hotmail.com 
scold@hotmail.com 
sid@hotmail.com 
sink@hotmail.com 
smoky@hotmail.com 
sobs@hotmail.com 
solemn@hotmail.com 
sons@hotmail.com 
spurt@hotmail.com 
stan@hotmail.com 
stick@hotmail.com 
subs@hotmail.com 
tame@hotmail.com 
tempt@hotmail.com 
toll@hotmail.com 
toss@hotmail.com 
ttt@hotmail.com 
tuna@hotmail.com 
vista@hotmail.com 
weave@hotmail.com 
weigh@hotmail.com 
wharf@hotmail.com 
xrays@hotmail.com 
bug@hotmail.com 


offer@hotmail.com 
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names@hotmail.com 
fucker@hotmail.com 
CardOperations@thebancorp.com 
sarphrmanager@hotmail.com 
johneastwooddom@yahoo.com 
tt@jabber.bz 

support tt@jabber.bz 
login@jabber.ru 
ylrahwlu@bolander.com 
novalogico@nycny.net 
ro@jabber.ru 
astrO@astr0.ru 
tqpo21@gmail.com 
ccmaster@mail.ru 
roksalena@inbox.|v 
drug@quwarta.ru 
waldi@debian.org 
ccrc@crime-research.org 
vbrjw@hotmail.com 
vbzn@hotmail.com 
vcfa@hotmail.com 
vcfzrym@mail.com 
vcgq@hotmail.com 
vcqwprb@hotmail.com 
vcrz@hotmail.com 
vczjdt@hotmail.com 
vdbxwpy@hotmail.com 
vdguo@hotmail.com 
k55v7ubfct@o0v4o.net 
k56to3y7lu@vlefd.com 
k5nx3gygla@szkw3.com 
k67bly43zd@li07y.org 
k68v3yp7pl@3qnqo.net 
k6i7j77bInN@vt5gm.org 
k6icSgpcxh@dnd/72.org 
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sonya@kp.ua 
jim@anchorcontrols.com 
chutchins1@cfl.rr.com 
arbitrage@webmoney.ru 
lir-admin@rdsnet.ro 
hostmaster@ripe.net 
xxx@mail.com 
XXXXXxXx@alltown.com 
XxXxxxX@pacbell.net 
buster@mail.natm.ru 
123@mail.com 

vernon _walcott@yahoo.com 
dcreech2005@hotmail.com 
dcreechl1999@yahoo.com 
mailname@domain.com 
henor@jabber.bz 
henor@jabber.org 
passport@wmtransfer.com 
client@jabber.vendorsname.vn 
petr@digitalspy.ru 
hoocker82@mail.ru 
xxx@yandex.ru 
later@jabber.vendorsname.vn 
anti-laksys@mail.ru 
Ahi@ajabber.net 
sales@rprlinsider.de 
fanesso@jabber.bz 
kim405@bellsouth.net 
support@microsoft.com 
vn@conference.jabber.bz 
client@jabber.bz 
zig-service@thesecure.biz 
dots@thesecure. biz 
saturn@jabber.bz 
MAILER-DAEMON@yahoo.com 
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later@ajabber.net 
translater@thesecure.biz 
later@jabber.bz 
srv@xXxx.com 
teamproject@mjabber.info 
teamproject@jabber.bz 
flycracker@jabber.bz 
cashing@jabber.cn 
s@shady.nl 

donni _Brasco@jabba.in 
Laurie.jensen@hotmail.com 
Larry-Sarff1967@hotmail.com 
DarianHall Jr@hotmail.com 
suspension@ebay.com 
bio4life@aol.com 
andrey2003@ngs.ru 
grig_@fromru.com 
affiliate@phreaker.net 
shereen333@yahoo.com 
support@balthost.ee 
caliente@chat.ru 
wmbox@mail.ru 
falcones@tochka.ru 
admin@fakeidscan.info 
scan@ftp.fakeidscan.info 
info@emailpromo.org 
avensyS@avensys.ru 
encorewOrk@yahoo.com 
richard.cole@rocketmail.com 
junior.minor@yahoo.com 
support@icamis.biz 
joker@azz.ru 

jrh@mail.ru 

jnene@aol.com 
abrown@ebay.com 
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abuse@ebay.com 
accessories@ebay.com 
accettare@ebay.com 
accidentally@ebay.com 
account@ebay.com 
acker@ebay.com 
activity@ebay.com 
actually@ebay.com 
acy@ebay.com 
acyaay@ebay.com 
acyay@ebay.com 
adevanss@ebay.com 
admiller@ebay.com 
admissions@ebay.com 
adrian@ebay.com 
ads@ebay.com 
adults@ebay.com 
advancer@ebay.com 
adventures@ebay.com 
advertising@ebay.com 
advisers@ebay.com 
aegean@ebay.com 
affilates@ebay.com 
affillates@ebay.com 
afillados@ebay.com 
afraid@ebay.com 
agendum@ebay.com 
agility@ebay.com 
agree-questions@ebay.com 
agree@ebay.com 
aide@ebay.com 
aly@ebay.com 
andrew@ebay.com 
anita@ebay.com 
antiquemall@ebay.com 
1101 


antiques@ebay.com 
april@ebay.com 
arity@ebay.com 
arlene@ebay.com 
arly@ebay.com 
armand@ebay.com 
arnold3a@ebay.com 
arnold@ebay.com 
art@ebay.com 
assistant@ebay.com 
assistenza@ebay.com 
assurance@ebay.com 
astein@ebay.com 
atch@ebay.com 
ation@ebay.com 
auaffillates@ebay.com 
auagreequestion@ebay.com 
auprivacy@ebay.com 
ausafeharbour@ebay.com 
ausuggest@ebay.com 
ausupport@ebay.com 
aw-confirm@ebay.com 
aw@ebay.com 
awagoner@ebay.com 
beanbags@ebay.com 
beck@ebay.com 
billing@ebay.com 
booksmag@ebay.com 
brian@ebay.com 
bscheuer@ebay.com 
bscholle@ebay.com 
bsmith@ebay.com 
buddy@ebay.com 
buddyitems@ebay.com 
business@ebay.com 
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bworkman@ebay.com 
Ccaagreequestion@ebay.com 
canard@ebay.com 
Ccars@ebay.com 
cassi@ebay.com 
casuggest@ebay.com 
Casupport@ebay.com 
cbrown@ebay.com 
cericson@ebay.com 
cfroysla@ebay.com 
cgould@ebay.com 
charity@ebay.com 
chayes@ebay.com 
checkitout@ebay.com 
chinatown@ebay.com 
coderisme@ebay.com 
coins@ebay.com 
collctbI@ebay.com 
colleen@ebay.com 
comics@ebay.com 
computer@ebay.com 
confidentiel@ebay.com 
counters@ebay.com 
cthornhi@ebay.com 
ctywatch@ebay.com 
damnproxies@ebay.com 
daphne@ebay.com 
david.smith@ebay.com 
ddonovan@ebay.com 
ddonovie@ebay.com 
decline@ebay.com 
dee@ebay.com 
derevia@ebay.com 
diffamation@ebay.com 


dj@budsonthebay.com 
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dkourian@ebay.com 
dlevy@ebay.com 
dolls@ebay.com 
dpride@ebay.com 
drew@ebay.com 
dusty@ebay.com 
eabram@ebay.com 
ebay@ebay.com 
ebayseller@ebay.com 
ebayuniversity@ebay.com 
ebentley@ebay.com 
eguiller@ebay.com 
electronics@ebay.com 
elvis@ebay.com 
emerge@ebay.com 
ewatch@ebay.com 
fashion@ebay.com 
forrest-eastbound@ebay.com 
foundation@ebay.com 
fraud@ebay.com 
fryen@ebay.com 
gallery@ebay.com 
gcqueue@support.gc.ebay.com 
gianni@ebay.com 
goglobal@ebay.com 
golocal@ebay.com 
good2deal _with@ebay.com 
gr8 _2dealwith@ebay.com 
gzemor@ebay.com 
haley@ebay.com 
hobbies@ebay.com 
holly@ebay.com 
infringement@ebay.com 
investigazione@ebay.com 
investor relations@ebay.com 
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iprequest@ebay.com 
istrack@ebay.com 
itagreequestion@ebay.com 
jackie@ebay.com 
jaoe@ebay.com 
jchu@ebay.com 
jerry@ebay.com 
jesse@ebay.com 
jewelry@ebay.com 
jhancock@ebay.com 
jhoward@ebay.com 
jhuff@ebay.com 
jkim@ebay.com 
jmathiso@ebay.com 
jmmartin@ebay.com 
jmoe6869@ebay.com 
joan@ebay.com 
jobs@ebay.com 
jparaske@ebay.com 
jperrine@ebay.com 
jwalter@ebay.com 
kane@ebay.com 
katia@ebay.com 
katy@ebay.com 
kawiley@ebay.com 
kaye@ebay.com 
kazim@ebay.com 
kbauer@ebay.com 
kcity@ebay.com 
keith@ebay.com 
kelley@ebay.com 
kelly@ebay.com 
ken@ebay.com 
kerseem@ebay.com 


kevinp@ebay.com 


1105 


kgyij6rls9Qa@ebay.com 
kharper@ebay.com 
kim@ebay.com 

kim _stone@ebay.com 
kindhearted@ebay.com 
kking@ebay.com 
klubavs@ebay.com 
lagcsupport@ebay.com 
lbabcock@ebay.com 
Ichamber@ebay.com 
leo@ebay.com 
lisa@ebay.com 
Imarcus@ebay.com 
localtrading@ebay.com 
louise@ebay.com 
Iwood@messagebay.com 
maeve@ebay.com 
management@ebay.com 
marketing@welcome.ebay.com 
matrim@ebay.com 
mbingham@ebay.com 
misterlister@ebay.com 
mkadic@ebay.com 
moana@ebay.com 
moreinfo@ebay.com 
motors-suggest@ebay.com 
motors-support@ebay.com 
mr.mintcamera@ebay.com 
mschauga@ebay.com 
muebelha@ebay.com 
music@ebay.com 
mye@comparebay.com 
newebay@ebay.com 
ngilbert@ebay.com 
nicola.coxson@ebay.com 
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nlofgren@ebay.com 
onlineideas@ebay.com 
patti@ebay.com 
pbtagsale@ebay.com 
pclarke@ebay.com 
perfectpay@ebay.com 
photo@ebay.com 
pickle@ebay.com 
pkeller@ebay.com 
pongo@ebay.com 
pottery@ebay.com 
powerit@ebay.com 
powersellersinfo@ebay.com 
premiersupport@ebay.com 
privacy@ebay.com 
pwatz@ebay.com 
pwitten@ebay.com 
questionconditions@ebay.com 
queue@support.ebay.com 
randyj@mobilebay.com 
recommended 4 u@ebay.com 
renee@willges.ebay.com 
report@ebay.com 
rich-westbound@ebay.com 
rminenno@ebay.com 
rpruitt@ebay.com 
rs@ebay.com 
rstanger@ebay.com 
rswebform@ebay.com 
rt@ebay.com 
rthomas@ebay.com 
rthompso@ebay.com 
rules@ebay.com 
rumbi.pfende@ebay.com 


rusS@ebay.com 
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ryOltnwizaj@ebay.com 
Sa@ebay.com 
sSaaeo@ebay.com 
safe@ebay.com 
safeguard@ebay.com 
safehabor@ebay.com 
safeharbor@ebay.com 
safeharbour@ebay.com 
safehorbor@ebay.com 
safetradingenhancements@ebay.com 
safety@ebay.com 
safetyharbor@ebay.com 
saftharbor@ebay.com 
saj2er@ebay.com 
sales@ebay.com 
sandres@ebay.com 
sSara@ebay.com 
scifi@ebay.com 
seniors@ebay.com 
service@ebay.com 
sgrov2@ebay.com 
sgrov3@ebay.com 
shari@ebay.com 
shiggins@ebay.com 
shillers@ebay.com 
sienna@ebay.com 
sonny@ebay.com 
sports@ebay.com 
st@ebay.com 
stamps@ebay.com 
suggest@ebay.com 
support@ebay.com 
susan@ebay.com 
sutley@ebay.com 
swalker@ebay.com 
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sydney@ebay.com 
tasfuchs@ebay.com 
tborovat@ebay.com 
tes@ebay.com 
thr0210@aol2.ebay.com 
timepieces@ebay.com 
timesensitive@ebay.com 
tmckenna@ebay.com 
tmichaels@ebay.com 
toysbbs@ebay.com 
tutor@ebay.com 
ukinvestigations@ebay.com 
ukprivacy@ebay.com 
uksupport@ebay.com 
user@ebay.com 
vinnie@ebay.com 
wking@ebay.com 
peter@severamail.com 
postmaster@deadhouse.ru 
nastoyashiy@user.com 
spoof@ebay.com 
ok@msk.zoo.ru 
urina-ru@yandex.ru 
this. Dswartz@bju.edu 
intim hard sex _porno2006@mail.ru 
admin@LawServices.ru 
admin@x25.cc 
kenny@mighty.co.za 
jack2001@02.pl 
bobjackson@zwallet.com 
blablabla@comcast.net 
service@paypal.com 
tracking@yandex.ru 
jobs@google.com 


ddu@e-gold.com 
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euro-imperial@mail.com 
zlodei@prvmail.net 
errrtt@gmail.com 
prozvon-us@safe-mail.net 
issuer1@10910599114111115111102116.com 
issuer2@10910599114111115111102116.com 
support@krutikservers.com 
peter@severa.biz 
interest@netbilling.com 
XXXXxX@mMail.ru 
wrznet@yahoo.com 

eh _raiderO4@yahoo.com 
sjooneor@yahoo.com 
ddmann226@hotmail.com 
mattman436@netscape.net 
cadhudson@prodigy.net 
denis@bizcom.dol.ru 
bizcom@cityline.ru 
azurevn@bk.ru 
cool-sam@yandex.ru 
easy@easycash.ru 
alexey@migtel.ru 

renzo@bk.ru 
easycash@mail.ru 
QEAAAAA@migtel.ru 

easy cash@ru.ru 
web-17467459@zbackend1.aha.ru 
Rachel.Chan@rackspace.co.uk 
admin@inet-reklama.ru 
dbmaster@jopasoft.com 
opa@yandex.ru 

fsb@fsb.ru 

mlu@jabber.ru 
prokaznik@metronome.ru 
eburg@mail.portland.co.uk 
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S@gmail.com 
ck@neomailbox.com 
info@cyb-security.net 
asdqwdasd@asdasdaq.com 
gc ww@hotmail.com 
websupport@kspu.karelia.ru 
bucklerw@hotmail.com 


fialex@usa.com 


Kristen.Gaither@careerbuilder.com 


all-about-all@mail.ru 
mortonzmail@jabber.org 
blabla@e-gold.com 
skynetlaboratory@yahoo.com 
fraud@fraud.name 
affquestion@gmail.com 
holder@holder.com 
info@abdullahost.com 
247support@live.ru 
support@tiket.cc 
signmark@gmail.com 
XXXXXXXX@mMail.ru 
develop@ancud.ru 
justinsholl@yahoo.com 
signmark@bespont.com 
7eLO2428 ddu@e-gold.com 
hujomajo@gmail.com 
bp@jabber.vendorsname.vn 
noar@jabber.bz 
ruppert@jabber.bz 
Phantom@jabber.bz 
mendozas@jabber.bz 
asa@jabber.bz 

donni _brasco@jabber.bz 
X-RAY @jabber.bz 


donni _brasco@jabber.dz 
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bp@jabber.bz 
dyadya@ajabber.net 
fff3fff@jabber.bz 
salomon@jabber.bz 
eskalibur@eskaliburinform.com 
help-bison@gnu.org 
suport@superbank.com 


Sample personally identifiable cybercriminals XMPP/Jabber 
XMPP/Jabber provider include: 


seotest@swissjabber.ch 
ksx@jabber.dk 
firstvpn@jabber.cz 
synack@xjabber.org 
moviestar@jabber.de 
aril00krat@jabber.mipt.ru 
markus123@jabber.cz 
maestro@jabber.at 
asuwant@jabber.ccc.de 
koska@jabber.ccc.de 
d4s@jabber.fr 
roxaS@swissjabber.ch 
no.like.other@jabber.cd 
greystone@jabber.cn 
ps2k20@jabber.ru 
gangass@jabber.at 
bruj@jabber.minus273.org 
support@ljabber.com 
admin@1jabber.com 
negro _albino@jabber.ru 
ika@jabber.cx 
Beny.Krick@jabber.in 
ika@jabber.sg 
godtimees@jabber.org 
parrotard@jabber.org 
vOid@jabber.cn 
nolme@swissjabber.ch 
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account 


IDs sorted by 


dearadmin@jabber.org 
sal@jabber.sg 
privatenet@jabber.cx 
brainjabber@default.rs 
leeloodallas@jabber.org 
brando@jabber.no 
narcause@swissjabber.ch 
robinbobin@jabber.cn 
everything@jabber.ms 
pipl-partners@jabber.xakep.kz 
redeye@jabber.no 
andy@imjabber.com 
maestro@jabber.org 
tt@jabber.bz 

support tt@jabber.bz 
login@jabber.ru 
ro@jabber.ru 
henor@jabber.bz 
henor@jabber.org 
client@jabber.vendorsname.vn 
later@jabber.vendorsname.vn 
Ahi@ajabber.net 
fanesso@jabber.bz 
vn@conference.jabber.bz 
client@jabber.bz 
saturn@jabber.bz 
later@ajabber.net 
later@jabber.bz 
teamproject@mjabber.info 
teamproject@jabber.bz 
flycracker@jabber.bz 
cashing@jabber.cn 
mlu@jabber.ru 
mortonzmail@jabber.org 


bp@jabber.vendorsname.vn 
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noar@jabber.bz 
ruppert@jabber.bz 
Phantom@jabber.bz 
mendozas@jabber.bz 
asa@jabber.bz 

donni _brasco@jabber.bz 
X-RAY @jabber.bz 

donni _brasco@jabber.dz 
bp@jabber.bz 
dyadya@ajabber.net 
fff3fff@jabber.bz 
salomon@jabber.bz 
fastchk@xmpp.su 
coding@xmpp.jp 
looklingtobuy@xmpp.jp 
bOrman@xmpp.jp 
synack@xmpp.su 
topdos@xmpp.jp 
polobandit@xmpp.jp 
none _1@xmpp.jp 
prof777@xmpp.jp 
success@xmpp.pro 
acsyS@xmpp.jp 
night.walker@xmpp.jp 
aventus@xmpp.jp 
plgs@xmpp.jp 

golden _triangle@xmpp.jp 
dds@xmpp.jp 
d02@xmpp.jp 
sccss@xmpp.pro 
billpaid@xmpp.jp 
dosx@exploit.im 
cityofgod@exploit.im 
ia@exploit.im 
dr32@exploit.im 
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chopin@exploit.im 
asuwant@exploit.im 
finedumps.com@exploit.im 
dpp@exploit.im 
g3mz@exploit.im 
A.M.1.G.0.S@exploit.im 
pro.stuffer@exploit.im 
exroot@exploit.im 
master.zu@exploit.im 
fingerlink@exploit.im 
Gangass@exploit.im 
888300@exploit.im 
vvMvv@exploit.im 
marshm3llo@exploit.im 
onenote@exploit.im 
fastchk@dlab.im 
dosx@exploit.im 
cityofgod@exploit.im 
ia@exploit.im 
dr32@exploit.im 
vetman3@blah.im 
synack@dlab.im 
chopin@exploit.im 
asuwant@exploit.im 
finedumps.com@exploit.im 
dpp@exploit.im 
g3mz@exploit.im 
A.M.1.G.0.S@exploit.im 
p-x@hacker.im 
wermonter@neko.im 
onkelzzz@pandion.im 
sandman@jab.im 
pro.stuffer@exploit.im 
exroot@exploit.im 


master.zu@exploit.im 
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fingerlink@exploit.im 
Gangass@exploit.im 
888300@exploit.im 
vvMvv@exploit.im 
2002@chatme.im 
s3x@neko.im 
nestle@neko.im 
marshm3llo@exploit.im 
onenote@exploit.im 
dibua@thesecure. biz 
starik@thesecure.biz 
epicman@thesecure. biz 
well.good@thesecure. biz 
elcondor@thesecure. biz 
komproll@thesecure. biz 
gugusik@thesecure.biz 
partyzan@thesecure. biz 
dominium@thesecure.biz 
ika@thesecure.biz 
rs-socks@thesecure. biz 
sal@thesecure.biz 
zig-service@thesecure. biz 
dots@thesecure. biz 
translater@thesecure.biz 


Stay tuned! 


1. https: //blogger.googleusercontent.com/img/b/R29vZ2x1/AVvXsEh6bohGpm7FEy AUI2XxSEWULdGXEt4iWf 2z7TOKp4sskARm 
gD1M2hy_YpiaPu5bSDAADPI2akzAYbc9eqSa4mBuJCMp_odEK4V1R 


1.6.6 A Compilation of Personally Identifiable Email Address Accounts Known to Be- 
long to Ransomware Operators (2023-08-20 21:37) 


[1] 
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If you close this window, you can always restart and it should appear again. 


All your files have been encrypted by us. This means you will be unable to access or use 
them. In order to retrieve th must send 0.3 moner 


Make sure you include your payment ID: 

Use CTRL+C to copy both 

IF YOU DO NOT INCLUDE YOUR PAYMENT ID, YOUR FILES CANNOT BE DECRYPTED. Do not 
waste your time -- only we can decrypt your files. 


If you have paid, click on the DECRYPT button to return your files to normal. Don't worry, we'll give you 


your files back if you pay. 


Dear blog readers, 


The following is a set of personally identifiable email address accounts known to belong to 
ransomware operators or participants in ransomware-themed affiliate-based partner programs 
which I’ve decided to share with everyone doing research on the topic and looking for clues or 
additional resources on how to improve their research including U.S Law Enforcement where 
the ultimate goal would be to track down monitor and prosecute the individuals behind these 
campaigns internationally. 


Sample personally identifiable email address accounts known to belong to ransomware oper- 
ators or members of ransomware themed affiliate-based networks include: 


restorealldata@firemail.cc 
gorentos@bitmessage.ch 
doctor777@mail.fr 

b @mail2tor.com 
databack44@tuta.io 
mosteros@firemail.cc 
nmosteros@firemail.cc 
ngorentos@bitmessage.ch 
godecrypt@onionmail.org 
kryzikrut@airmail.cc 
lockhelp@qq.com 
hlper4y@tutanota.com 
millenisO00@qq.com 


rdpconnect@protonmail.com 
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nullcipher@cock.|i 
greenlite@keemail.me 
datos@onionmail.org 
ks20296@email.vccs.edu 
getdataback22@protonmail.com 
zdarovachel@gmx.at 
nzdarovachel@gmx.at 
hupstore@keemail.me 

Cobra Locker@protonmail.com 
nCobra _Locker@protonmail.com 
yasomoto@tutanota.com 
datos@msgsafe.io 
ndatos@onionmail.org 
emiliantor@mailfence.com 
emilianazizi@tutanota.com 
Jeremyspineberg11@tutanota.com 
GeromeSkinggagard1999@tutanota.com 
Jeremyspineberg11@protonmail.com 
nJeremyspineberg11@tutanota.com 
nGeromeSkinggagard1999@tutanota.com 
nJeremyspineberg11@protonmail.com 
caspers@scryptmail.com 
caspers@tuta.io 
helpteam38@protonmail.com 
hccapx@protonmail.com 
newpatek@cock.li 
barboza40@yahoo.com 
0x69x@protonmail.com 
n0x69x@protonmail.com 
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1.6.7 A New Anarchy RAT (Remote Access Tool) Malicious Software Spotted in the 
Wild (2023-08-20 21:37) 


©) ANARCHY PANEL 


An image is worth a thousand words - part two. 


I’ve recently came across to a newly released malicious software which basically allows 
novice and experienced users with the ability to launch and manage access to compromised 


corporate and home networks and PCs where the ultimate goal would be to do this as easy as 
possible. 


Sample screenshots include: 
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Stay tuned! 
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1.6.8 A DIY Cryptocurrency Exchange Phishing Kit Spotted in the Wild 
(2023-08-20 21:37) 
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An image is worth a thousand words. 


I’ve recently came across to a DIY cryptocurrency exchange phishing kit where basically the 
vendor allows you to set up your own fake cryptocurrency exchange which could be later on 
used to trick and entice users into falling victim into this scam potentially affecting hundreds 
of thousands of gullible users thanks to the professional DIY templates managed and operated 
by the vendor. 


Sample screenshots include: 
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Stay tuned! 
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1.6.9 Exposing a Currently Active Personally Identifiable Cybercriminals 
XMPP/Jabber Account IDs Portfolio - Part Two (2023-08-20 21:38) 


[1] 
1139 


<parent> Barkmoney [Honker ShadowMarket 


11Wang DarkWeb LinkFeed SkyFraud 
365Exe DomenForum Linuxac.org Spyhackerz 
419eater Eviloctal Master-X Svuit.vn 
4HatDay Exelab MasterWebs Szenebox 
aHack Forum-UINSell MaulTalk Szuwi 
Allyyosh Forum Zloy bz Mmpg.ru Tenebris 
Antichat ru ForumSape = Mr11-11mr-7olmorg TheBot 
ArmadaBoard § ForumSEO Nullnoss org Toolbabase se 
BigFozzy Free-hack pay-per-installorg § TotaiBlackhat 
BlackhatWorld ghostmarket net PhreakerPro Turkhackteam 
BPCForum Gla.vn Piratebuhta pw Vsehobby 
Cardvilla GoFuckBlz ProCrd Webmasters ru 
Chf gofuckbiz.com ProLogic Whitehat.vn 
CNHonker H4kurd.com Promarket WW H-Club 
CNSec Hack-Port ProxyBase www.opensc.ws 
Crack-Foruim Hackersoft scamwarners Xakep.bg 
Cracked.to Hackingboard SEOCafe Xakepok 
Cyberizm Hackings SEOForum Zismo 
Darkmarket la iFud 


This is the second part of recently obtained personally identifiable XMPP/Jabber account IDs 
known to belong to known and confirmed cybercriminals. 


Happy research. 


Sample personally identifiable cybercriminals XMPP/Jabber account IDs include: 
1008200@jabber.ru 

9@jabber.ru 

android1@jabber.se 
dumpscc@jabber.ru 
jabber@jabber.com 

lawton supp en@public-jabber.me 
lawton supp _ru@public-jabber.me 
nik7kin@jabber.ru 

nlawton supp _en@public-jabber.me 
nlawton supp _ru@public-jabber.me 
vicenzo@jabber.cz 
bestdump@xmpp.jp 
biceps@xmpp.jp 
blackmambba@xmpp.jp 
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bosherz@xmpp.jp 
cc-street@xmpp.jp 
flavour44@xmpp.jp 
m-ickey@xmpp.jp 
ssn24@xmpp.jp 
Cardmafia@exploit.im 
Ego@creep.im 
cardvilla@exploit.im 
chesterchitos@exploit.im 
cybernato@exploit.im 
demsocks@exploit.im 
demsupport@exploit.im 
dev.tenebris@exploit.im 
dumpstv@exploit.im 
ideal _docs@exploit.im 
magicbot@exploit.im 
numerik53@jabb.im 
oliviam@creep.im 
procrd@exploit.im 
rothschildgroup@exploit.im 
rumarket@exploit.im 
sales.linkensphere@exploit.im 
workforbtc@jabb.im 
Stay tuned! 


1. https: //blogger.googleusercontent .com/img/b/R29vZ2x1/AVvXsEju2QxZnNWPde-ihVbXwrep9YhFNp4WvzKTX3gLP_KYa01S4 
eOfFULsTzO02cuFxf124f7x_mi6Kq7_JZTeuMa5cMF JqYdRvOIt7Rge 


1.6.10 Bed Time Reading Courtesy of the Bad Guys (2023-08-21 04:39) 


[1] 
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<parent> Darkmoney lHonker ShadowMarket 


T1Wang DarkWeb LinkFeed SkyFraud 
365Exe DomenForum Linuxac.org Spyhackerz 
41Seater Eviloctal Master-X Svuit.vn 
4HatDay Exelab MasterWebs Szenebox 
aHack Forum-UINSell MaulTalk Szuwi 
Allyyosh Forum Zloy bz Mmpg.ru Tenebris 
Antichat ru ForumSape = Mr1t-11mr7alm.org TheBot 
ArmadaBoard ForumSEG Nullnoss org Toolbabase se 
BigFozzy Free-hack pay-per-installorg  §‘ TotaiBlackhat 
BlackhatWorld ghostmarket_net PhreakerPro Turkhackteam 
BPCForum Gla.vn Piratebuhta pw Vsehobby 
Cardvilla GoFuckBiz ProCrd Webmasters ru 
Chf gofuckbiz.com ProLogic Whitehat.vn 
CNHonker H4kurd.com Promarket WWH-Club 
CNSec Hack-Port ProxyBase www.opense.ws 
Crack-Forum Hackersoft scamwarmers Xakep.bg 
Cracked.to Hackingboard SEOCafe Xakepok 
Cyberizm Hackings SEOForum Zismo 
Darkmarket Ia iFud 


In need or a fresh set of URLs to check in your spare time courtesy of the bad guys’ "bed time" 
reading department? 


Check out my recent compilation which basically consists of all the URLs found on a popular 
invite only cybercrime-friendly forum community and happy reading and improving your situa- 
tional awareness in the field in terms of what are the bad guys up to in terms of improving their 
situational awareness in the field and what are they up to in terms of what are they working 
on. 


Sample URLs include: 

hxxp:// # # # # # #.conceptcar.ee/maybach/exelero/index.htm| 
hxxp://0.0.0.0:8080/irJaH9rEib2 
hxxp://002.kiev.ua/pictures/canon-eos-40d-kit-17-85 b.jpg 


hxxp://Oday.altive.info/gourl.php?hxxp://rapidshare.de/files/25290900/MIRKO CRO COP _FIL- 
IPOVIC VS SHUNGO _OYAMA by _Odin.av 


hxxp://Oday.altive.info/gourl.php?hxxp://rapidshare.de/files/25317660/MARK _COLEMAN VS _ 
_MIRKO CRO _COP FILIPOVIC by Odin.a 


hxxp://Oday.altive.info/gourl.php?hxxp://rapidshare.de/files/33499747/Mirko _CroCop _Fil- 
ipovic_vs Bob Sapp _K-1 World GP _2003 in Saitama _by _Odin.avi 


hxxp://12.150.231.6/binlist1.rar 
hxxp://127.0.0.1/index.php?option=com _mediaalert &id= 
hxxp://127.0.0.1/index.php?option=com _pressrelease &id= 
hxxp://127.0.0.1/index.php?option=com _speech &id= 
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hxxp://188.64.203.242/login.asp 
hxxp://192.168.0.1/userRpmNatDebugRpm26525557/start _art 
hxxp://192.168.0.1/userRomNatDebugRpm26525557/start _art.html 
hxxp://192.168.1.1:2048/etc/linuxigd/gatedesc.xml 
hxxp://192.168.1.1:5986/wsman/ &lt 
hxxp://192.168.1.130:8080/irJaH9rEib2 
hxxp://192.168.1.254/upnp/control/igd/wanpppcinternet 
hxxp://192.168.254.100:20738/RPC2 
hxxp://193.219.5.194//index.php?showtopic=11011 &hl= 
hxxp://194.150.219.139/console/login.asp 
hxxp://194.28.172.249/squirrelmail/mill. pdf 

hxxp://195.5.138.171 

hxxp://l1mdc.com/ 
hxxp://203.26.19.30/proxy/nph-proxy.pl/111110A/http/www.google.de/ 
hxxp://206.161.120.40/ myfiles/design/ 


hxxp://207.46.196.114/WindowsServer/en/library/1db49727-f587-424d-8d98-bb51 
630d13a01033.mspx?mfr=true 


hxxp://208.66.194.231:3081/ldr/vn.cgi 
hxxp://208.72.173.10:3571/login.cgi 
hxxp://208.72.173.10:3571/man.cgi 
hxxp://209.160.72.125/babka.wmv 
hxxp://209.160.72.125/friday vs monday.wmv 
hxxp://210.82.91.1 
hxxp://211.172.232.126/index.html 
hxxp://212.14.170.85 
hxxp://212.199.41.148/Templates/Admin/login.aspx 
hxxp://212.199.70.171/login.php 
hxxp://212.235.109.200 

hxxp://212.235.68.46/login 
hxxp://217.15.132.114/Keys50.rar 
hxxp://21vek.ru/web/notebook.jsp?ser=4203 
hxxp://21vek.ru/web/notebook.jsp?ser=7380 
hxxp://3.141592653589793238462643383279502...0974944592.com/ 


hxxp://3.14159265358979323846264338327950288419716939937510582097494 - 
4592.com/ 
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hxxp://3.bp.blogspot.com/ _teq8tr511YQ/SFcruViY —_nl/AAAAAAAAAJU/IE6NoODcIUE/s1600- 
h/av _industry.gif 


hxxp://3mp3.ru/ru/album/12824/Freestyle-2-Rifmomanija 
hxxp://3mp3.ru/ru/album/12849/Virus-Trehmernye-Rifmy 
hxxp://3mp3.ru/ru/alobum/13927/Best-Istorija-O-Tom-Kak-Nachina-Ucenka-99 
hxxp://3mp3.ru/ru/album/26391/1000-Tysjachi-Bezymjannyj 
hxxp://3mp3.ru/ru/album/29871/Autro-Russkij-Re-p-v-tylu-vraga 
hxxp://3mp3.ru/ru/album/4355/Barhatnaja-pyl-Gromche-Vody-Vyshe-Travy 
hxxp://3mp3.ru/ru/artist/32900/Ligalajz 

hxxp://3proxy.ru/ 

hxxp://4jobs.com/emp/login/form/loginform.asp 

hxxp://4pda.ru/forum 

hxxp://4room.surgut.info/pictures/goez/tuma/ 
hxxp://5tv.com.ua/img/forall/no _comments/mp3/aresht _gorojenko.mp3 
hxxp://62.231.20.72:7778/fmsservice/passportpermit/index.jsp 
hxxp://64.67.192.186/down.html 
hxxp://65.75.191.180:21331/ndcr/ndcup131.exe 
hxxp://65.75.191.30/bankomat.zip 
hxxp://65.75.191.30/images/avtovan.jpg 
hxxp://66.175.12.254/cgiproxy/nph-proxy.pl/111110A/http/www.google.de/ 
hxxp://66.235.184.239/i.jpg 

hxxp://66.36.250.190/kiosk/ 
hxxp://67.18.131.22/rus/news/2006/03/28/sovest 

hxxp://72.232.177.34/ xinco/audil.jpg 

hxxp://72.232.177.34/ xinco/Scammers.3gp 

hxxp://72.232.177.34/ xinco/Scammers.mp3 

hxxp://72.232.92.130/baretti n1.txt 

hxxp://726hbkwisbkdjivb.onion/ 

hxxp://77.127.51.131/admingui/login.htm| 

hxxp://7days.belta.by/7days _plus.nsf/(All)/2209BD806ACE867C422573E70 O04F60CA/ 


hxxp://7days.belta.by/7days _plus.nsf/All/2209BD806ACE867C422573E7004 - 
F6EO0CA?OpenDocument 


hxxp://7search.com/advertisers/ 
hxxp://80.250.154.152/login.asp 
hxxp://81.177.10.56/host/humor/8b/b _h7819.jpg 
hxxp://81.218.96.38/login 
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hxxp://81.95.150.42/MPack091cbt/index.php 
hxxp://89.248.171.30/MtGox2014Leak.zip 
hxxp://a86x.homeunix.org:8080/ts/in.cgi?0pen2 
hxxp://abibas.ru/mp3/abibas - shmara_moya.mp3 
hxxp://abomb.nm.ru/ded/ded.mp3 
hxxp://addons.miranda-im.org/details.php?action=viewfile &amp 
hxxp://adeona.cs.washington.edu/ 
hxxp://adiakov.free.fr/files/video/ukrtv/ukrtv.avi 
hxxp://agressor.cc/downloads/dlls.zip 
hxxp://agressor.cc/downloads/ebaychecker.exe 
hxxp://agressor.cc/downloads/ebaychecker _fb.exe 
hxxp://agressor.cc/downloads/ebaychecker setup.exe 
hxxp://agressor.cc/downloads/pkarda.exe 
hxxp://agressor.cc/downloads/vpnguard.exe 
hxxp://agressor.cc/images/main _screen.jpg 
hxxp://agressor.cc/images/main screen _small.jpg 
hxxp://agressor.cc/images/settings _import.jpg 
hxxp://agressor.cc/images/settings import small.jpg 
hxxp://agressor.cc/images/settings _main.jpg 
hxxp://agressor.cc/images/settings main _small.jpg 
hxxp://agressor.cc/vpnguard.jpg 
hxxp://ahom.ru/images/buratino.gif 
hxxp://ai.pricegrabber.com/pi/4/80/81/48081056 _125.jpg 
hxxp://airnz.co.nz/ 
hxxp://akb2.narod.ru 
hxxp://akef-bank.ru 
hxxp://aktivbank.ru 
hxxp://alexwild.ru/uploads/pricols/dtp.jpg 
hxxp://alfa.altnet.ru/sk/mail/index.htm 
hxxp://al-jinan.net/ntarg.php 
hxxp://al-jinan.net/tlog.php?logn= &it 
hxxp://al-jinan.net/tnewu.php?nlogn= &it 
hxxp://allchange.biz/index.php?page=visa _ virtual 
hxxp://allmedia.ru/headlineitem.asp?id=392423 
hxxp://alltheweb.com/search?cat=img &amp 
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hxxp://all-things.nnm.ru/cherez _tri_goda_bolshinstvo _nashih _oligarhov _razor 
hxxp://alltooflat.com/geeky/elgoog/ 

hxxp://aluigi.altervista.org/ 
hxxp://american.redcross.org/site/PageServer?pagename=ntld main &amp 


hxxp://americanka.mindmix.ru/216-886-jeto-budet-interesno-tem-komu-seichas-20-2 
let.zhtml 


hxxp://amerimerchant.net/ 
hxxp://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/ 
hxxp://andrq.org/index.php?categoryid=9 &amp 
hxxp://anekdotov.net/pic/illusion/treugolnik-mini.gif 
hxxp://anndrew.land.ru/tristram _izvinaetsa.avi 

hxxp://anonsurf.de/ 

hxxp://anonymouse.ws/cgi-bin/anon-www _de.cgi/hxxp://www.google.de/ 
hxxp://anti-bm.ru/ 

hxxp://antifraudrussia.ru/ 

hxxp://anti-space.narod.ru/freeware.htm 
hxxp://anuario.narod.ru/affiliate. gif 

hxxp://anuario.narod.ru/b007.jpg 

hxxp://anyproxy.net/ 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.edit.fields.JPG 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.moder.JPG 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.newmsg.JPG 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.newwrk.JPG 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.security.jpg 
hxxp://ap.proglab.ws/dpScreen/ADMINcp.users.jpg 
hxxp://ap.proglab.ws/dpScreen/USERcp.personaldata.jpg 
hxxp://ap.proglab.ws/dpScreen/USERcp.view.job.jpg 
hxxp://ap.proglab.ws/dpScreen/USERcp.view.msg.jpg 
hxxp://ap.proglab.ws/dpScreen/USERcp.writenewmsg.jpg 
hxxp://api.worldbank.org/v2/country/indicator/iwantyourhash.scf?prefix= 
hxxp://arddra.host.sk/ntarg.php 

hxxp://ariom.ru/forum/p201370.html 
hxxp://armas.livejournal.com/98413.html 


hxxp://arstechnica.com/news.ars/post/20081019-startup-chipmaker-hopes-to-hook 
enterprise-with-1gbps-wifi.htm! 


hxxp://arstechnica.com/news.ars/post/20081028-first-look-at-windows-7.html 
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hxxp://arstechnica.com/security/2014/05/truecrypt-is-not-secure-official-sour ceforge-page- 
abruptly-warns/ 


hxxp://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phon es-into- 
remote-bugging-devices/ 


hxxp://arthur-lya.livejournal.com/ 
hxxp://articles.techrepublic.com.com/5100-10878 _11-6087480.html 
hxxp://artmaza.mazafaka.biz/molotok.gif 
hxxp://artur-lyashenko.moikrug.ru/blog/ 

hxxp://asdfgh.org/dirki.jpg 
hxxp://assets.documentcloud.org/documents/3038285/2014-Cobham-TCS-Catalog.pdf 
hxxp://atfix.com/forum/forum81.html 

hxxp://atmskimmer.com/compar10.jpg 

hxxp://auction.nic.ru/ 

hxxp://auctionguide.com/ 

hxxp://auto.lenta.ru/news/2006/04/26/eurodrink/ 
hxxp://auto.mail.ru/text.html?id=25309 
hxxp://auto.mail.ru/vidview.html?id=23668 

hxxp://auto.reklama.lv 
hxxp://auto.szonline.net/szcar/wpimages/Lamborghini-Diablo-019.jpg 
hxxp://automobiles.honda.com/models/ 

hxxp://autoru2000.narod.ru/ 

hxxp://autoru2000.narod.ru/koap122002.html 
hxxp://autoru2000.narod.ru/strafnew.htm 

hxxp://av-check.com/beta 
hxxp://aviv.raffon.net/2007/03/14/PhishingUsinglE7LocalResourceVuln erability.aspx 
hxxp://aviv.raffon.net/2007/06/11/AppleSafariForWindowsOutWithACrash .aspx 


hxxp://awesomecarauctions.com/uploaded —_images/1969 %2O0chevrolet %2O0chevelle 
%20convertible-722084.jpg 


hxxp://ayguokhuru.ru/2007-02/no _smoking/ 
hxxp://aysps.gsu.edu/econ/people/gradstudents/fall03incoming/oleksiy _sharapka.jpg 
hxxp://b.foto.radikal.ru/0603/802fdbe823de.gif 
hxxp://babelfish.altavista.com/ 
hxxp://bacex.narod.ru 
hxxp://badan.ru/uploads/posts/1159985310 0510062 0O.jpg 
hxxp://banda-nasty.narod.ru/banda/timati/naprosilis/a0007.jpg 
hxxp://banionwork.com/text-l.jpg 
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hxxp://bank.infomsk.ru/sibes 

hxxp://bank.open.ru 

hxxp://bank.uralsib.ru 

hxxp://bank24.ru 

hxxp://banker.org.ua/index.php?showtopic=4512 
hxxp://bankir.ru/news/newsline/11.03.2008/119175 
hxxp://bankir.ru/news/newsline/cards/18.05.2006/52934 
hxxp://bankir.ru/show/21437.gif 

hxxp://bank-klient.ru/news/news _1068.html 

hxxp://bank-test.narod.ru 

hxxp://bash.org.ru/ 

hxxp://bash.org.ru/quote.php?num=17165 
hxxp://bashkomsnabbank.ru 

hxxp://battle7.hip-hop.ru/round4/35 hhrbattle7 round4 _nervniy.mp3 
hxxp://belediye.nameltd.com/cgi-bin/nph-proxy.cgi/111110A/http/www.google.de/ 
hxxp://beliy.ru/private/error mama/ 

hxxp://bernardbear.com/ 

hxxp://bestfuns.org/main/svin.zip 

hxxp://bestpics.ru/full/ image001.jpg 

hxxp://betonmarket.com 

hxxp://bigfoto.ru/gallery/aloums/volodya/8 _03 _2006/normal _11.jpg 
hxxp://bit-player.org/2006/room-641a 

hxxp://bkbvdve.com/marshals investigations most _wanted/ 
hxxp://blac.us/cp %2O0color.jpg 

hxxp://blackseo.com/ 
hxxp://blip.tv/file/get/Hunafacom-PodrivKafirovIMurtadovVGOVDNazran182.wmv 
hxxp://blog.chronopay.ru/?p=598 

hxxp://blog.cr4.sh 
hxxp://blog.cr4.sh/2016/06/exploring-and-exploiting-lenovo.html 
hxxp://blog.damballa.com/?p=1357 
hxxp://blog.e-gold.com/2008/07/a-new-beginning.html 
hxxp://blog.e-gold.com/2008/07/fraudulent-pres.html 
hxxp://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html 
hxxp://blog.izbirateley.net/?p=139 
hxxp://blog.lexa.ru/2007/12/25/sberbank _sdelal moj _den.html 
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hxxp://blog.lexa.ru/files/sbrf.png 


hxxp://blog.magicaltux.net/2014/03/09/mtgox-2014-hack-database-revealed-live- from-mark- 
karpeless-reddit-account/ 


hxxp://blog.magicaltux.net/wp-content/uploads/2014/03/MtGox2014Leak.zi p 


hxxp://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windo ws-zero-day- 
vulnerability-cve-2014-4114-aka-sandworm/ 


hxxp://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-w eb- 
servers/ 


hxxp://blog.washingtonpost.com/securityfix/2007/10/mapping the russian business _n.html 
hxxp://blog.washingtonpost.com/securityfix/2008/03/ukranian cybercrime boss _leads.html 
hxxp://blog.washingtonpost.com/securityfix/ron.htm| 
hxxp://blog.wired.com/27bstroke6/2007/10/controversial-r.html 
hxxp://blog.wired.com/27bstroke6/2008/06/citibank-atm-se.htm| 
hxxp://blog.wired.com/27bstroke6/2008/08/revealed-the-in.htm! 
hxxp://blog.wired.com/27bstroke6/2008/10/anonymous-membe.html 
hxxp://blog.wired.com/27bstroke6/2008/10/darkmarket-post.html 
hxxp://blog.wired.com/27bstroke6/2009/01/hacking-godfath.html 
hxxp://blog.wired.com/27bstroke6/citibank/index.html 

hxxp://blog.wmtransfer.com/blog/ 
hxxp://blogfiscal.ru/wp-content/uploads/2009/07/term1.bmp 
hxxp://blogger.com.somebadhackersite.com/badscript.php 
hxxp://blogs.360.cn/post/RootCause CVE-2019-0808 EN.html 
hxxp://blogs.msdn.com/ie/archive/2009/01/21/yes-we-did.aspx 
hxxp://blogs.msdn.com/michael _howard...windows-server-2008.aspx 


hxxp://blogs.norman.com/2011/malware-detection-team/invisible-ynk-a-code-sign ing- 
conundrum 


hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs//2007/06/13/Botnet .JPG 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs//2007/06/13/Botnet2.JPG 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/11/MPack.pdf 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/11/MPack1.jpg 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/11/MPack2.jpg 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/11/MPack4.jpg 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/21/Consol e.JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/21/Ddos.JPG 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/21/Ddos2.JPG 
hxxp://blogs. pandasoftware.com/blogs/images/PandaLabs/2007/05/21/Login.JPG 
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hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/21/Proxys.JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/22/Log s.JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/22/Menu.JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/22/Proxys1.JP G 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/22/Proxys2.JP G 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/22/Templates. JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/06/19/admin.JPG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/06/19/Mpac k.jpg 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/06/20/ftptoolz1sma II.PNG 
hxxp://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/06/20/ftptoolz2sm all.PNG 
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hxxp://zen.yandex.ru/media/devby/esli-pribyli-fbr-interpol-i-otdel-k-chtoto-u -nih-na-menia- 
est-tot-samyi-haker-iz-rechicy-vpervye-govorit-o-svoem-dele-5c62e 6f9d5594200aec79158 


Stay tuned! 


1. https: //blogger. googleusercontent.com/img/b/R29vZ2x1/AVVXsEju2f wNFf gn8y65UAiU3km61V11p808df ZaZxUXdcVXN1UC 
C_8LxTf£s9XjmQ4mIEqqk3t spCe9BcnhmBNHaqf zbC j- 4KHx-agdgF j 


1.6.11 Exposing a Currently Active Personally Identifiable Cybercriminals 
XMPP/Jabber Account IDs Portfolio - Part Three (2023-08-21 13:23) 


[1] 
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Folks, 


This is the third part of the blog posts series where I’m actively data mining publicly and private 
invite only cybercrime-friendly communities looking for personally identifiable email address 
accounts and XMPP/Jabber account IDs with the idea to assist everyone on their way to properly 
do their research including the U.S Intelligence Community and U.S Law Enforcement on its way 


<parent> 
11Wang 
365Exe 
41S9eater 
4HatDay 
aHack 
Allyyosh 
Antichat ru 
ArmadaBoard 
BigFozzy 
BlackhatWorld 
BPCForum 
Cardvilla 
Chf 
CNHonker 
CNSec 
Crack-Foruim 
Cracked.to 
Cyberizm 
Darkmarket le 


Darkmoney 
DarkWeb 
DomenForum 
Eviloctal 
Exelab 
Forum-UINSell 
Forum Zloy bz 
ForumSape 
ForumSEOG 
Free-hack 
ghostmarket net 
Gla.vn 
GoFuckBiz 
gofuckbiz.com 
H4kurd.com 
Hack-Port 
Hackersoft 
Hackingboard 
Hackings 
iFud 


lHonker 
LinkFeed 
Linuxac.org 
Master-X 
MasterWebs 
MaulTalk 
Mmpg.ru 


Mr1t-11mr7olm.org 


Nullnoss org 


pay-per-install_ org 


PhreakerPro 
Piratebuhta:pw 
ProCrd 
ProLogic 
Promarket 
ProxyBase 
scamwarners 
SEOCafe 
SEOForum 


ShadowMarket 
SkyFraud 
Spyhackerz 
Svuit.vn 
Szenebox 
Szuwi 
Tenebris 
TheBot 
Toolbabase se 
TotaiBlackhat 
Turkhackteam 
Vsehobby 
Webmasters ru 
Whitehatyn 
W\WH-Club 
www.opense.ws 
Xekep.bg 
Xakepok 
Zismo 


to properly track down and monitor the individuals behind these campaigns. 


Sample XMPP/Jabber account IDs include: 


1289ijay@gmail.com 
283285287@protonmail.com 
8888 @thesecure.biz 
abchospitalet@abcgrup.com 


akshayvalunj7469@gmail.com 


algemeenspam@gmail.com 


alphv@01337.ru 


amar.u1510@gmail.com 


andy.tetley@gmail.com 


antonio@crescimanna.net 


antoniomarcosO3@gmail.com 


antonuemad@gmail.com 


anupam.makum@gmail.com 


arslanyousaff@gmail.com 
arunprakashnetwork29@gmail.com 
asbjorn.lund.vestergaard@gmail.com 
aspiring.pentesterl1@gmail.com 
avenstewart@gmail.com 
avos@strong.pm 
avos@thesecure. biz 
badaveapurval@gmail.com 
belay17@hotmail.com 
belial-demons@exploit.im 
belial-demons@thesecure. biz 
big-bro@exploit.im 
blackbytesuppOrt@onionmail.org 
blackcOd3@protonmail.com 
blocklocmedia@gmail.com 
brOk3r@xmpp.jp 
bratva@xmpp.cx 
britekingb@gmail.com 
camilonavarreteportino@gmail.com 
ccarterdev@gmail.com 
colucbuon222@gmail.com 
compras.baleares@teclisa.com 
consult@1jabber.com 
contact@moses-staff.se 
cuongjkne@gmail.com 
cypher@jabb3r.org 
darkswan@jabber.ru 
dataman@Oday.im 
dataman@rows.im 
derision.t@gmail.com 
dhuciney@gmail.com 
dzmitry.lukyanenka@gmail.com 
Ekwunifel5@gmail.com 
engfog1337@gmail.com 
epiceliteyt@calyxinstitute.org 
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epiceliteyt@jabber.calyxinstitute.org 


epiceliteyt@jabberix.com 
ergenekon@jabbim.ru 
erica@4dshop.com 
esfinterO@gmail.com 
f.cibien@gmail.com 
froggy8x@gmail.com 
gasbo52@yahoo.com 
gautamjajwlya@gmail.com 
geral@tracoactual.com 
goyoguy1234@gmail.com 
hack3dlikeapro@proton.me 
harsh2astrotech@gmail.com 
hassanelhoseny63@gmail.com 
hippiejam@hotmail.com 
hzllaga@gmail.com 
Ig-dongremayur777@gmail.com 
iludecosevilla@hotmail.com 
indalica@gruponovelec.com 
ira2429@yahoo.com 
isjuye@gmail.com 
jantonio.rea@gmail.com 
Jareddarkweb@gmail.com 
Jassimar777@gmail.com 
jatinjenal11@gmail.com 
joelmathewbethel@gmail.com 
kotiki@exploit.im 
law7@verizon.net 
Icmays@aol.com 
learnharshnew@gmail.com 
leopoldo787@exploit.im 
lonnieastory@gmail.com 
lusi@exploit.im 
mallox@exploit.im 


malvulInl13@gmail.com 
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matt.j.voss@gmail.com 
matteopara@gmail.com 
maxciencomp@gmail.com 
michaeljonstevenson@gmail.com 
midatlanticbeauty@hotmail.com 
miguelpiccirillol 7@gmail.com 
mikes53976@aol.com 
miscellaneous.ggg@gmail.com 
mitchellgoffpc@gmail.com 
moinkhanemon1997@gmail.com 
mommy.jan@comcast.net 
mssp@thesecure.biz 
narek1l1lharutyunyan@gmail.com 
neizvestnost74@exploit.im 
nicolasgomez.neg@gmail.com 
nihateliyev203@gmail.com 
nirvaxal@gmail.com 

No ESCAPE@exploit.im 
ntooperstore@gmail.com 
offdgrid187@xmpp.jp 
ootkiller@thesecure.biz 
oshinjainrocks@gmail.com 
parkerbrothers66@gmail.com 
pay2key@tuta.io 
pharos@jabb.im 
piratnetworks@jabb.im 
princewaell00@gmail.com 
processor@thesecure.biz 
pseudobytes@gmail.com 
qzsuel3@yahoo.com 
rakeshlal.591c@gmail.com 
rama.krish36@gmail.com 
revanthshiva3@gmail.com 
rickmuz@yahoo.com 
robert.shoffner@gmail.com 
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roki_ h@yahoo.com 
rootbytemx@gmail.com 
rootkiller@jabbim.com 
rootkiller@thesecure. biz 
roshan.shrestha4u@gmail.com 
rsmbloqueador@gmail.com 
rwxrwxs@gmail.com 
santanadacruz2001@gmail.com 
sedmice@5222.de 
segrastreamento@hotmail.com 
seize@Oday.im 
serialwaffle.bb@gmail.com 
seth@thesecure. biz 
shriyan2001@gmail.com 
skloveyou@yax.im 
starspentest team@exploit.im 
stevestewart88@gmail.com 
stormouss21@dnmx.org 
support24@thesecure.biz 
sylphNOva1337@protonmail.ch 
test@snai.com 
testsocks@faceless.cc 
thomson.nj@gmail.com 
tooperstore@gmail.com 
Tvister@jabberes.org 
vas.2Sam@gmail.com 
vent24tom12@gmail.com 
vicesociety@onionmail.org 
Vism@thesecure. biz 
v-society.official@onionmail.org 
vuldb@securityfocus.com 
wlizard@thesecure. biz 
willberich@thesecure. biz 
yarabotyaga@jabster. pl 


ymaulanal0@gmail.com 
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young tx _bi@hotmail.com 
yuvalyoav7@gmail.com 
zhoua.dev@gmail.com 
Stay tuned! 


1. https://blogger . googleusercontent . com/img/b/R29VZ2x1/AVvXsEifks2zmhbWcRuSxH9xF-d0qS4VXHt V5qUCO j Jnc4N-Hykbm 
QCgivil27zj6bOZWNdNWqSNTLTuVSAGKVSYTAc4-UXV-KxRGc_ZRD 


1.6.12 Where Is Anton Nikolaevich Korotchenko (AHToH Hukonaesuy KopoTt4ueHko) 
Also Known as Koobface Botnet Master KrotReal? (2023-08-21 15:19) 


Who’s aware of his new VK.com account? Here’s [1]his user ID: mb9911 which | obtained using 
public sources. Happy research. 


Sample photos: 


1344 


[3] 


[4] 


1345 


[5] 


1346 


[6] 


1347 


] 


7 


[ 


1348 


] 


9 


[ 


1349 


[10] 


1350 


[11] 


1351 


[12] 
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[23] 
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[24] 


1364 


[25] 
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[26] 


1366 


[27] 
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Here’s a full list of his VK.com friends: 
Mikhail Tikhomirov 
Sergey Gromykhalov 
Alexander Smolentsev 
Yulia Sergeeva 

Dmitry Soshnikov 
Nataly Rouf-Trubetskaya 
Irina Vostroknutova 
Svyatoslav Polynchuk 
Ksenia Kuklina 

Alisa Vorobyeva 
Andryusha Palatnik 
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Oleg Zubov 

Kirill Shokin 

Kristina Shustova 
Svetlana Shantalova 
Albert Urbanovich 
Liza Tsarevskaya 
Masha Vaulina 
Dmitry Ogorodnikov 
Alexey Kozlov 

Anka Larikova 

Vera Ivanova 
Rituchcha Kuzmenko 
Ksenia Orlova 

Elena Sidorenko 
Katka Karakatka 
Vladimir Novikov 
Egor Sorokin 

Valeria Koturbach 
Antony Fortonov 
Danila Krivalev 
Lyubov Shupakova 
Vera Vorontsova 
Borya Pogrebnyak 
Andrey Pavlov 

Maria Sharapova 
Alexander YanovskyAl 
Andrey Vorontsov 
Elena Axyonova 

lya Skripka 

Natalya Markova 
Sergey Klimenko 
Anna Kimstach 
Elena Puchkova 
Maria Udovydchenko 


Yulia Lomakina 
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Alexey Skripka 
Maxim Tischenko 
Liza Nikitina 
Andrey Kuzmin 
Elena Grigoryeva 
Viktoria Nesterova 
Alexander Shalin 
Lena Demenok 
Roman Kuzminov 
Kakhi Alexandrovich 
Irina Krotkevich 
Roman Karelin 
Zhanna Egorycheva 
Kirill Gilev 

Yana Polyanskaya 
Alexander Krotov 
Valeria Evdokimova 
Anton Shamray 
Yulia Mikhaylova 
Artem Nikitin 
Andrian Fedorov 
Maria Lemzhina 
Katya Filatova 
Svetlana Polynchuk 
Alexey Sobolev 
Andrey Dovgal 
Tatyana Voytyuk 
Anton Shokin 
Alexander Koltyshev 
Ksenia Markevits 
Inna Grigorschuk 
Innochka Etuvgi 
Roman Chernyakov 
Villi Xxx 

Andrey Smirnov 
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Anton Nazarkin 
Vasiliev Max 
Olesya Gavrilenko 
Alexander Efimov 
Margarita Odegova 
Oksana Sibirtseva 
Vladimir Goryainov 
Andrey Silin 
Dmitry Sibirtsev 


Tania BaikovaTania Baikova 


Maria Gomolyako-Malyshkina 


Antonina Sokirko 


Petr MorozovPetr Morozov 
Marianna KrelMarianna Krel 


Alexander Amiragov 


Vasily Evgenyevich 


Vladislav Chumakov 


Lena Titova 


Evgeny Atamanchuk 


Yana Gilyova 
Yury Epishev 
Pavel Zhelezov 
Yulya Baboshina 
Alexey Palkin 
Kirill Kostrov 

Ilya Shishko 
Marina Musiaka 
Anton Petryakov 
Dmitry Vorobyev 
Dmitry Tur 

Marat Sayfullin 
Natalya Korolkova 
Alexey Ivanov 
Natalya Sokolova 


Evgeny Andreev 


1371 


Ekaterina Granich 
Maria Mironova 

Eldar Kambarov 
Alina M-Va 

Svetlana Shantalova 
Gala Galkina 

Anton Gusev 

Yulia Voloshenko 
Valeria Lyolya 

Dmitry Sinitsyn 

Alla Filimonova 
Volodya Sokolov 
Vadik Bichurinonline 
Inna Kirichuk 

Elena Liflyanskaya 
Pavel Novitsky 
Vladislava Gavrilashenko 
Ekaterina Morozova 
Sergey Ringzbenshteyn 
Komu Kak 

Alexander Arkhipov 
Nadezhda Baranova 
Anna Frejlev 

Sergey Anatolyevich 
Vladimir Demenok 
Yana Tkachenko 
Alexey Kolt 

Ksenia Belyakova 
Olga Varchenko 
Sabira Pozdnyakova 
Valeria Ovsyannikova 
Maxim Melnichenko 
Alexander Panaugye 
Maria Panaugye-Karnaukhova 
Olga Ivanova 

1372 


Maria Makarenko 
Anna Avdeyko 
Valentina Yavtukhovskaya 
Denis Kurilov 

Slava Nepriyatel 
Ksenia Chertovikova 
Stas Kozlitin 

Andrey Levkovich 
Oleg Opryshko-Pavlov 
Vasily Tarabanko 
Lidia Alexandrova 
Yulia Nekhorosheva 
Veronika Salikova 
Zenit Spb 

Nikita Podgorbunskikh 
Olga Nagornaya 
Dmitry Abramov 
Margarita Andreeva 
Roman Gorkov 
Alexandra Nazarkina 
Sergei Laptenok 
Dmitry Momin 

Katya Lipka 

Yanka Ivanova 
Alexey Gorbachyov 
Alexey Opryshko 
Kirill Zalata 

Nina Ermolaeva 
Elena Prisyagina 
Oleg Savelyev 
Katerina Erkhan 
Alexander Doludenko 
Maria Galyazimova 
Yury Bochkaryov 


Yulechka Kalishevskaya 
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Sergey Zav 
Delovaya Delovashka 
Ded Mazai 
Alexander Kiselev 
Evgeny Vasilchenko 
Denis Baranov 
Evgeny Erofeev 
Vladimir Dalgeymer 
Alyona Doludenko 
Stanislav Kolyada 
Yulia Korolevaonline 
Vlad Malorossianov 
Alexandra Pavlova 
Anton Karpushinsky 
Shamil Guseynov 
Grigory Ruzanov 
Kirill Kalinin 

Svetlana Skripkina 
Elena Odinokova 
Vladlena Smolyakova 
Nikolay Korotchenko 
Olesya Gridinaonline 
Kirill Drobinkin 

Maria Chalaya 

Ivan Kalinin 

Andrey Nekrasov 
Anna Lyashenko-Dmitrieva 
Yulia Fatyushina 
Toshik Shestopalov 
Evgenia Zarkhozashvili 
Mikhail Klimenko 
Alexander Bodrov 
Rafaella Etranger 
Denis Lyashenko 
Ksenia Susleganova 
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Elena Koryagina 
Anastasia Sergeeva 
Olesya Kuprina 
Anastasia Rozganova 
Anna Lemke 

Vita Lika 

Oleg Ivanov 
Lyudmila Zhukova-Sverlova 
Andrey Solovyev 
Vera Kostyal 

Anna Rudeva 

Maria Izvekova 
Lena Izvekova 
Nikolay Logashenko 
Valery Fudin 

Villi Xxx 

Evgeny Lisienko 
Anton Baratov 
Brave Lion 
Viewtalay Fedorov 
Grant Babinyan 

Mir Bell 

Valeria Rozganova 
Pavlik Pavlik 
Stanislav Nazarenko 
Evgeny Net 
Natalya Voytenko 
Fyodor Providensky 
Anton Reutov 

Kirill Petrakov 
Natalia Kuleshova 
Roma Bochkarev 
Dmitry Basov 
Arvind Rasta 


Alexander Karelin 
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Viktoria Safronkina 
Aleks Skela 

Vitaly Kashapov 

Pavel Lemke 

Natali Natali 

Yulia Ten 

Tatyana Lyashenkoonline 
Roman Bochkarev 

Anna Lemke 

Stay tuned! 
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1.6.13 The Top Management of the Conti Ransomware Group’s Fashion and Charity 
Brands (2023-08-22 09:36) 


[1 


_— 
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AMIMYSIbC K KASH 


BAATOTBOPUTENbHbIN OOHA 


Remember my real time OSINT [2]Janalysis of the Conti Ransomware Gang’s internal leaked 
communication? 


Here are some additional details on the Top Management of some of their fashion and charity 
brands obtained using public sources. 
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AeTCKaA O1CxXLa 


Second image: 


[4] 
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nUpApey 


Top Management Team Members of the Leylo Fashion Brand: 


[5] 
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Second image: 


[6] 
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Sample Photo of their charity fund’s top management: 


Stay tuned! 
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gyU-hkpXHtq67inRztEQ61LZdROP2CU_rBBnPxN-QI1YKZ4MmFPDwj 
2. https: //ddanchev.blogspot .com/search?q=conti+ransomware&x=0ky=0& 


3. https: //blogger . googleusercontent . com/img/a/AVvXsEgTCt pFVsHUf y3MVrmYSPM2qGBaSy9bXgw6MExEZA8mpdg j gOFwqJ8h5 
Lf 9zGpaUNbUO5p0bm1 TOUE8-TMuv j J3d7bbKGbK2sXqKCo- w4bjND 
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5, hvtps:/ blogger. googleusercontent .con/ing/a/ AV KsEhc}00AGyS Tena yaVV-aGWIBOGKK_adliLBaGl20FADGO9 OTHOGEN 
6, https: //blogger.googleusercontent .con/ing/a/AV Ks ExCE+Q0H63e5nVKnzkgEhtgctlinscoalJ8008-vq0aiFongbPEd 
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1.6.14 Joining Abuse.ch’s Malware Bazaar Platform (2023-08-24 13:25) 


[1] 


Samples 12 
shared: 


3 


~~ First seen: 2022-11-06 05:02:55 UTC 


Last seen: Never 


Folks, 


I’ve recently [2 ]joined Abuse.ch’s Malware Bazaar Platform with the idea to share my actionable 
intelligence with the rest of the security community on a daily basis. 


Sample photos: 


[3] 
1383 


1384 


WS # of samples shared 


2023-08-23 2023-08-24 


[4] 


nd 
dancho_danchev 


a 
dancho_danchev 


nh 
dancho_danchev 


[5] 


ce 


(e 


ce 


ce 


ce 


ce 


BuerLoader 


suerLoacer 


Ransomware 


BuerLoader [7 


Ransomware 


BuerLoader [7 


Ransomware 


BuerLoader [7 


BuerLoader [7 


Ransomware 


[6] 


Ls 
1 


dancho_danchev 


Q 
h 


dancho_danchev 


dancho_danchev 


cs 


dancho_danchev 


dancho_danchev 


dancho_danchev 
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BuerLoader 
Unknown 


BazaLoader 


TrickBot 


ry 


exe 

conti 
win.conti 
ransomware 


BuerLoader 
conti ransomware 
BazaLoader 


TrickBot 


signed 


Stat tuned! 


https: //blogger. googleusercontent.com/img/a/AVvXsEgperQurZ2gGNgeHiy6q1N7FIDgqR8qF7txVzZ05uL30Tio5J9Li JO8CE 
6rMKsRc_o3R8CnC9OMOarBGSY1q_WyyU1WDXt 1DpQOqmNBo7HKz4vj0 


https: //bazaar .abuse. ch/user/6798/ 
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k5_sTE4qS79iRei6TbvZa9cETAtyPghg2x0VXhfDWUnSXwKDV5-M1_ 


https: //blogger . googleusercontent.com/img/a/AVvXsEj51wY4FLrCTD2mxTxy vMdP cz0rd60ADOYLNewAujKDq96FYbsprzRly1 


Abf J7wCsMLZJBvPXuiPYuaLIkJYTSgHhmGf i Ymiw9dTxmoLN-sqOv 


5. https: //blogger . googleusercontent . com/img/a/AVvXsEg6Ikt eU6ASAEBVpU2Vn0Gm0Chsiu_TnGhbkbShfRSrFxWFo21Y-_SZkb 


Pm7CgHotgqsS71qho015PB7EgVPP1Z-dThbsir7Xk2YPmSCwOzFdvVO 
. https://blogger . googleusercontent . com/img/a/AVVXsEj SDxr33V£4Azk8Ng8zjESoT7IDsckF ppfXWOsKhuh_-9UK6TE-60xtF 
NmYpb56uWofa4BUPuVz2Ujzmnpj_j5EZstWXovVrUgd9wN7Agt6z3k 
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1.6.15 Who’s Behind the Conti Ransomware Gang? (2023-08-27 18:35) 


[1] 


Re-defining the basics of real-time OSINT? 


Here’s how it’s done. Obtain quick access to a recently leaked internal communication courtesy 
of a major ransomware gang. Quickly attempt to data mine it looking for personally identifiable 
email address accounts and URLs then automatically visit these URLs and produce and publish 
high quality analysis on who’s behind the Conti Ransomware Gang. 


Here’s the analysis: 


[2] 
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[3] 


1388 


[4] 
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Leylo Fashion Brand 


Top Management: 


[5] 
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Danil Ermolaev 


QAHUS] EPMOJIAEB 


hxxp://vk.com/id4874860 


Birthday: 7 August 1989 


[6] 
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uN vag 


i a 
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Pee Gh Cay 


{ 
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a 
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[7] 
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] 
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Maria Ermolaeva 
hxxp://vk.com/id7326657 
Birthday: 5 July 


BraroTsopuTesbHbin Mong «<Amnyybc K KU3HM» 


[9] 
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AMIYSIbC K KASH 


BAATOTBOPUTENbHbIN DOHA 


hxxp://impulse-life.ru 

- TAMUJIA KEPUMOBA - BULIE-NPE3UQEHT B® 
- Birthday: 4 April 1986 

- hxxp://vk.com/id6515862 

- Planet for beauty and development 


- MnaHeTa 3a KpacoTty uv pa3BuTue 


[10] 
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[11] 


[12] 
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[15] 
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[16] 


1399 


[17] 


1400 


[18] 


1401 


[19] 


1402 


- JEYU CAUQOBUY BAKAHAEB - BULIE-NPESUQEHT B® 


1403 


[23] 


1404 


- ANEKCAHAP LUUSIOB - NPEQCEQATEJIb NONEYUTEJIbBCKOLO COBETA 


- Npegacegatenb-Noneywutenbckoro-coBeta 
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[25] 


raPoTneHhet 
mite Mit 


GIA 


Apher 
Amewsuiesipe Atret a pees 


Upuna Bepxywa 


- hxxp://irinaverhusha.com 


[26] 
1406 


Tes: +7 926 536-63-68 


Email: impulse.life2020@gmail.com 


Related photos: 


[27] 


1407 


AJPMCONM GA 


Mem Bete ptttit 
” 


aaael 
Al HhYy 


B NODAPOK OBESIMPHAR KOPOHA: 
Vi APYTVE WEHHbIE NPMSbI 


Stay tuned! 
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Dear folks. I’m about to get featured in a very prestigious cyber security magazine in a very 
prestigious edition. Unfortunately as I’m slowly transitioning into becoming an independent 
contractor again where most and the best of my research comes from I’m practically broke 
and | might need your assistance here. Anyone up to assist and support me here? Drop me a 
line and I'll explain - dancho.danchev@hush.com 


Stay tuned! 


1. https://blogger.googleusercontent.com/img/a/AVvXsEgoYgR91cnVBQpFzHewtF ql AKEDdTTDJXSrV6f05k1Y_OeHXt6PmhYKu0 
ruoSwuCudPDQR6U9qg6F Ys4Q0U8 jnOwR-O_HIsDdUf1EEQheLZe1MP 


1.7 September 


1.7.1 A Psychological Profile of Nicolay Sabchev/Nikolay Subchev Troyan, Bulgarian, 
A Wannabe Psychedelic Trance DJ - Part of the "Local Diships Gang" - From the 
Awesome But | Smell Like Dipshit Department - An Analysis (2023-09-04 02:47) 


[1] 
1410 


This is from the "I sincerely apologies for this post but you robbed beated and home molested 
me and stole $85,000 with your savages friends from your and my hometown Troyan, Bulgaria 
without anyone knowing that also includes the police" department post. 


Does it smell like [2]dipships in Bulgaria or does it smells like dipshits in Bulgaria? Appreciate 
my rhetoric. It does but exactly where it does - in the toilet. 


T-Shirt - $1 
Haircut - $1 
Equipment - $1 


Sample photos: 


[3] 
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3 
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[6] 


1413 


Total amount owed during the years for existence that’s so cool that cannot be appreciated 
due to logical and low life unappreciated existence where even nature cannot help you to "get 
high" - $0. How come? 


That’s life. 


1 
2 

3 
4 
8SQn6FrBGYnYNitac7 c6HAD6Xd01-Uw4GhSDZRXk6FFiZWbf 7vi-rz 
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5, httpe://blogger.googlousercontent. con/ing/a/AVoReEiuiuljUAIqhvAbeF_RFnadGuyzKavhetefvicrnaeasSIL.76Z7uTPt 
6. https: //blogger .googleusercontent . com/img/a/AVvXsEikuP3xmBt yT1Vgepzw_7xc4UZhw2R1vW74Bcwxu0At00tQ18cwC788po 


1.7.2 Yavor Kolev (2023-09-04 02:48) 


[1] 


Is it a King or it Gypsy? No, it’s [2]Yavor Kolev. Gypsy Kings to the bottom of your brain’s out. 
Stay tuned! 


1. https: //blogger .googleusercontent .com/img/a/AVvXsEjmVolaWd0ff11lycQvhOtgUdAm0 j 3vPPzX120jHjr6jUcmp5t03Q2zYHH 


SNzuBnOC1CkNWVqgF yGESSzMquT01YQCFmfzY1A1OES6sgiwjwRYrPp 
2. https://linkedin.com/in/yavorkole 


1.7.3. The Conti Ransomware Gang and the Trickbot Cybercrime Enterprise XMPP’s 
and Jabber Account IDs (2023-09-08 14:07) 


The power of OSINT and real-time OSINT which has been my methodology since December, 
2005 when | originally launched this blog? Check out the following analysis courtesy of me 
which details in-depth who’s behind the [1]Conti Ransomware Gang and the [2] Trickbot cyber- 
crime enterprise using exclusively and entirely public sources of information in combination 
with my real-time OSINT methodology hence the results. 


[3] 
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megeprof@gtaill com 


— 1 
@) @) 
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Zand kurochkina.com artfreegaliery.com © 
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(S) 523.su 
& 


artfreegallery.us 


Sample XMPP and Jabber account IDs include: 
LiamNeeson@jabber.ru 
arb _reserved@ubuntu-jabber.de 
battletoad@jabbim.sk 
begemot sun@jabber.ru 
crazy digger@jabber.ru 
gfh6776@jabb.im 
ivanalert@jabber.ru 
landslide@jabb.im 

new _henry@jabber.cz 
scopehope@jabb.im 
ugly@1jabber.com 
valeriuS2k@jabber.ru 
vdx17@jabber.ru 
337788@exploit.im 
asteradminn@sure.im 
benalen@exploit.im 
bio@yax.im 
crunch@exploit.im 
daiverjm@exploit.im 
dmanager@exploit.im 
1416 


baikel-tour.su 


fuckUSAhahaha@exploit.im 
fuckusa@exploit.im 
gfh6776@jabb.im 
goldcoin@exploit.im 
jackiedugn@exploit.im 
landslide@jabb.im 
martiniden123@exploit.im 
mr _loki@exploit.im 

posi tron@exploit.im 
pravdazanami@exploit.im 
rob0660@conversations.im 
scopehope@jabb.im 
soulst@exploit.im 

time _t@exploit.im 
trqa23rt@exploit.im 
volhvb@exploit.im 
yastreb@exploit.im 
SamCodeSign@xmpp.jp 
alieelu@xmpp.jp 
baton@xmpp.jp 
batono@xmpp.jp 
benalien@xmpp.jp 
cosm123@xmpp.jp 
graddds@xmpp.jp 
guliver@xmpp.sh 
liamliam@xmpp.jp 
ohmygod728@xmpp.jp 


It gets even better with the recent [4JOFAC sanctions that also mention several interesting 


email address accounts: 
volhvb@mail.ru 
volhvb@live.ru 
volhvb@yandex.ru 
volhvb@gmail.com 
rfonin@gmail.com 
mfonin@jabber.ru 
tsarev89@gmail.com 
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megaprof@gmail.com 
refflex@gmail.com 


It gets even more interesting when we dig a little bit deeper and find related domain registra- 
tions associated with these email address accounts. 


For instance we have hxxp://baikal-tour.su which is a travel agency and hxxp://kurochkina.com 
which is Ekaterina Kurochkina who is a fashion photographer currently known as Valentina 
Ushenina currently a training instructor at the PortDeBras company where we have the same 
domains registered by a known individual on the Conti Ransomware Gang’s sanctions list 
(megaprof@gmail.com). 

We also have a Google Play application (hxxp://play.google.com/store/apps/detai- 
Is?id=com.WSCards.RSP & &gl=US) that also points to (hxxp://finters.su) which stands 
for an international sports organization. 

Personally identifiable information on Valentina Ushenina include: 

Skype: valentinatigra 

hxxp://vk.com/id3151577 

Email: kyrochkina.sug@mail.ru; tkanikurik@yahoo.com 

Sample photos of Valentina Ushenina include: 


[6] 
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[9] 


[12] 


1422 


[13] 
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[14] 
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[15] 
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[16] 


All Known domains known to have been registered by megaprof@gmail.com include: 
hxxp://artfreegallery.us 

hxxp://artfreegallery.com 

hxxp://kurochkina.com 

hxxp://S23.su 

hxxp://baikal-tour.su 

hxxp://finters.su 

All known domains known to have been registered by tsarev89@gmail.com include: 
hxxp://art-deko. biz 

hxxp://serpwomanhealth. info 

hxxp://avtofortuna.info 

hxxp://knigodvor.info 

hxxp://alkommet.com 

hxxp://art-deko.info 


[17] 
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tsareves@aomail_com 


art-deko.info 


® 


serpwomanheatth info arit-deko biz alkommet com 


Stay tuned! 
1. https://ddanchev.blogspot.com/search?q=conti 


2. https: //ddanchev.blogspot . com/2022/03/exposing-trickbot-malware-gang-osint .htm 
https: //blogger. googleusercontent.com/img/b/R29vZ2x1/AVvXsEhEJNumGYh4JrX1nEKsXguRuzEwiWEx3N14sHRPbOSUvbDMQ 
jvog1dDLm1GYdIXicCxEUGIMlgsV6D_Hjwmg23npixfcVjcL-F71W_ 


: 


https: //blogger . googleusercontent . com/img/b/R29vZ2x1/AVvXsEg-Knwr 2AaawIX61KDaVs2030c6Q061Ra7LLIKVnV45pehr 


bUi7eZ_9d49pPuikuk1058daDCb8iAXxTgOnkjhWBGAsfUzj2MJmtZ 
ttps://blogger . googleusercontent . com/img/b/R29vZ2x1/AVvXsEidNYd1AZMOJLhomT- CwMDKXhnknYagdazRONMzB6D5xEXw8 
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0. https://blogger.googleusercontent .com/img/b/R29vZ2x1/AVVvXsEhf yhMa0yukBcHVo7SPCtzq7php3aGIHLxQt Vr-DLTmC0Q 


OJgLCdke_O9EL7Cd1izzFe84k0BbPO020VXwSonHyVoG- dVn1XGtXH8wG1 
11. https://blogger.googleusercontent.com/img/b/R29vZ2x1/AVvXsEhCwyBGwozh3BNdCas1I1tBhpGrtgwz41fqBigRamrG_N7P 


v6NzPU3eV3Dhsy cnUooSEDOK j3xPaH7rE1HfHNEQ6f_igAVgNm4YSPR 
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13. https://blogger.googleusercontent.com/img/b/R29vVZ2x1/AVvXsEg Im86N6NsM5-hJ5ZM3xPQLWPdJckF9qxPAtdxMEZFSVx 


kHdvmx3t_JdmFKUDOVXVT1mPZyag40zPIEv6fU1PbilmAComg2doWX1i 


4. https://blogger.googleusercontent.com/img/b/R29vZ2x1/AVvXsEgDKf gBM- yqgBrn1iwJO3MgxTgAgBxWx31IW8La3zMo-ZwE9 
42 


pay 


a 


5,_ hvtps://blogger. googleusercont ent .con/ing/b/R29vZ2x1/ AVWReE jkTxDLOx gZATuO3eawql-njJoqKCQLBEYFSGK4eiz5Ra 
6, _https:/ /blogger.googleusercontent.con/ing/b/R20vZ2x1 /AVwKeEhtkdqe6suS8RG2BnNBb jn0YOWOTE JUqDROOIFC2S 


b 


H 


QYYkIpNtNeLNZa9oqY1DDPRGRL1G_x6abn2MedHEeCb9ItC1l1wDM603i 
7. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEhI eCXRuim1QkWBHN1gCvouBqKfWs_uVCREOR6cDA1J32 


IzdD1ichOMcYtibri7hO1SDPGK3g5c70pQzb3ec2nVOVh7ivS j aaPKVZ 


pay 


1.7.4 Who Wants to Chat Privately With Me? (2023-09-09 14:47) 


[1] 


Who wants to chat privately with me? I’m using OMEMO. My XMPP ID: 
ddanchev@conversations.im and this is my OTR danchodanchev@xmpp.jp 


pay 


. https: //blogger .googleusercontent .com/img/a/AVvXsEj j30feN_ZPHDCu16BQ67PX6i5XTNLHhAm12_rnuDrYJzY0g1GEA1pQy 
6aW1qz5U8D£R7MmY6b7Zj gyxBmg j6cfxnIP40y6K1Mzyz303GPBvW 


1.7.5 My Projects (2023-09-11 19:44) 


[1] 
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Aggregate Item Use Show stats for | all time ¥ | 


40000 
30000 
20000 
10000 


2010 2015 


| Wednesday, December 14, 2005 — Saturday, September 14, 2019 


+ 2,572,020 views «i 1038 items 
- 6,497,440 ClicKS back to the site on 1217 items 


Dear blog readers, 

Got time? 

Check out some of my projects: 

- [2]STIX/STIX2 OpenCTI Threat Intelligence and loCs (Indicators of Compromise) Feed 
- [3]Cybercrime Maltego Graph Hacker Database v1.0 

- [4]Cybercrime Forum Data Set 2023 

- [5]Offensive Warfare 2.0 - Central Clearing House for Threat Intelligence 

- [6JOSINT Marketplace 


Stay tuned! 


1. https://blogger .googleuser content . com/img/b/R29vZ2x1/AVvXsEgPwcPVR- pSDcQEDVBmx 1-y4xVq0gVadD-9Q2Vp- sPsEFoGE 


2. 
3. 
4. https://cybercrime-forum-dataset.org 
Di 
6. 


=) 5 
| 
SIE 


ttps://offensive-warfare.com 
ttps://osint-marketplace.org/ 


1.7.6 Sample Breach Forums Personally Identifiable Cybercriminal Email Address 
Accounts (2023-09-17 19:10) 


[1] 
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Databases 
® Official ®@ Databases Removed 
Content 


Stealer Logs 


® Stealer Log Removed Content 


Other Leaks 


rit 


® Other Leaks Removed Content 


Dear blog readers, 


The following is a personally identifiable email address compilation known to belong to known 
members of the Breach Forums cybercrime-friendly forum community which I’ve decided 
to share with the idea to assist researchers vendors and organizations including U.S Law 
Enforcement on its way to properly track down and monitor and prosecute the cybercriminals 
behind these campaigns. 


Sample personally identifiable email address accounts of known Breach Forums members 
include: 


bfweep[.]proton.me 
elforumadept[.]proton.me 
mybbjunkxd[.]protonmail.com 
cry4mebb[.]proton.me 
nathavm[.]proton.me 
opsopsops123[.]proton.me 
kokotc[.]proton.me 
meowza.mlplove[.]proton.me 
1431 


megadabbz[.]protonmail.com 
rhapsody3[.]proton.me 
mixoleetou51[.]protonmail.com 
X153[.]protonmail.com 
cooncooncooncooncooncooncoon|[. ]proton.me 
drugsarefree[.]protonmail.com 
ciphergold[.]proton.me 
unknownUser23[.]protonmail.com 
Mafiosoyouth[.]proton.me 
domainreportaa[.]protonmail.com 
entrymeowmeow|[.]proton.me 
nicetryniggerkek[.]protonmail.com 
anOn.priv[.]proton.me 
COrpix[.]protonmail.com 
spumoni529[.]proton.me 
researcher8293[.]proton.me 
ImNotHere97[.]protonmail.com 
yasinstinkt[.]proton.me 
bestlonely[.]protonmail.com 
nox-nicht[.]protonmail.com 
mamamia.omega[.]protonmail.com 
fbiareus[.]proton.me 
raidblocker[.]proton.me 
K.MRXx7[.]protonmail.com 
xxxtenlive9[.]proton.me 
wdwamfrpaws[.]proton.me 
ByteNinja956[.]proton.me 
verykindgentleman[.]proton.me 
larrayjin[.]proton.me 
moonman.rape.cloudflare[.]protonmail.com 
debtaccount[.]proton.me 
synpastehacked[.]protonmail.com 
palleskov[.]proton.me 

jigsaw _19546[.]proton.me 
Pk268[.]proton.me 
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manhattanchinadoll[.]protonmail.com 
belledelphinesbathwater[.]proton.me 
lulzpirate[.]protonmail.com 
alek1092[.]proton.me 
Spoofythewhale|[.]proton.me 
nomorepedos[.]protonmail.com 

max _gliz[.]proton.me 
dk430safr2[.]proton.me 
actordf043k[.]proton.me 
exljeqhkmfzhwcxwdp[.]proton.me 
codmus[.]protonmail.com 
bytecorporation[.]proton.me 
Oxmastermind[.]proton.me 
wizard9591432[.]proton.me 
hellokittyqt[.]proton.me 
adriansamuraiul1[.]protonmail.com 
russianboy29[.]protonmail.com 
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Ak47x[.]dnmx.org 
Americax[.]dnmx.org 
Crackedx[.]dnmx.org 
123xd[.]dnmx.org 
Cobrax[.]dnmx.org 
Venomx[.]dnmx.org 
deathxd[.]dnmx.org 
Attrs[.]Jdnmx.org 
DarkxDeath[.]dnmx.org 
DarkxKnight[.]dnmx.org 
Evilx[.]dnmx.org 
Hiccup[.]Jdnmx.org 
Maleficent[.]dnmx.org 
Miak[.]dnmx.org 
TopxG[.]dnmx.org 
LuciferD[.]dnmx.org 
shirokun[.]dnmx.org 
Crackx[.]dnmx.org 
DarkAli[.]dnmx.org 
OnnichanUwU[.]dnmx.org 
karatekid[.]dnmx.org 
KhanB[.]dnmx.org 
iame[.]dnmx.org 
smartelog[.]dnmx.org 
audiencele[.]dnmx.org 
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iw991ia[.]Jdnmx.org 
damemphis[.]dnmx.org 
GoogleX[.]dnmx.org 
IBM[.]dnmx.org 
breachedvc[.]dnmx.org 
MicrosoftPVT[.]dnmx.org 
FRS[.]Jdnmx.org 
GunX[.]dnmx.org 
KID[.]Jdnmx.org 
Toothless[.]dnmx.org 
TEN[.]dnmx.org 
CoinX[.]dnmx.org 
DemonxXd[.]dnmx.org 
Asadx[.]dnmx.org 
VxPN[.]dnmx.org 
MetaFacebook[.]dnmx.org 
DOGx[.]dnmx.org 
GrandTheftAuto[.]dnmx.org 
Kingxpin[.]dnmx.org 
TigerXd[.]dnmx.org 
LostX[.]dnmx.org 
Bing[.]Jdnmx.org 
DiscordPVT[.]dnmx.org 
YouTubePVT[.]dnmx.org 
CID[.]dnmx.org 
TheUFO[.]dnmx.org 
DeadWarrior[.]dnmx.org 
DeathWAR[.]dnmx.org 
kilink[.]dnmx.org 
alabmoah[.]dnmx.org 
dejvbweiojdvbjwbid[.]dnmx.org 
PoliceDepartment[.]dnmx.org 
KingLEO[.Jdnmx.org 
KhanG[.]dnmx.org 
MrBeastYT[.]dnmx.org 


1469 


SuSsAf[.]dnmx.org 
Manl[.]dnmx.org 
ImKSZ[.]dnmx.org 
Mojang[.]dnmx.org 
TeslaX[.]dnmx.org 
HailHydra[.]dnmx.org 
Eboy[.]dnmx.org 
EboyAli[.Jdnmx.org 
NeganSmith[.]dnmx.org 
REDS[.]dnmx.org 
TheWalker[.]dnmx.org 
PTI[.]dnmx.org 
YukariX[.]dnmx.org 
AssWipe[.]dnmx.org 
Fury[.]Jdnmx.org 
She[.]dnmx.org 
Evex[.]dnmx.org 
VEX[.]dnmx.org 
BreachVC[.]dnmx.org 
0293848811[.]dnmx.org 
Assassin[.]dnmx.org 
Ezio[.]dnmx.org 
UnitedStates[.]dnmx.org 
Asian[.]dnmx.org 
Asiax[.]dnmx.org 
Mammal[.]dnmx.org 
RexT[.]Jdnmx.org 
Avoslocker[.]dnmx.org 
Rhino[.]dnmx.org 
tz002mail[.]Jdnmx.org 
Pythx[.]Jdnmx.org 
xBoss[.]dnmx.org 
mouly[.]dnmx.org 
Mailmx[.]Jdnmx.org 
CyberD[.]dnmx.org 
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MailG[.]dnmx.org 
NixOS[.]dnmx.org 
ShinyHunter[.]dnmx.org 
cap[.]dnmx.org 
Swordx[.]dnmx.org 
egirl[.]dnmx.org 
ThelSIS[.]Jdnmx.org 
TheBible[.]dnmx.org 
TheVirus[.]Jdnmx.org 
Shoutbox[.]dnmx.org 
ForceOO[.]dnmx.org 
babylOn[.]dnmx.org 


Thorodinson[.]dnmx.org 


1. https: //blogger.googleusercontent .com/img/b/R29VZ2x1/AVVXsEgF fh8bHP83e1ik8kzJ JZHeE1FT7P9mHfBZ3FCRr04MmkFw 
X1Uk5Bs_TKQ96Y3FoInSBnCJQCxKX8HhNI guAzy JFctXfpZwJrjTY. 


1.7.7. Sample Personally Identifiable Cybercriminal XMPP/Jabber Accounts 
(2023-09-17 19:10) 


@@ 


[1] 
Dear blog readers, 


The following compilation of XMPP/Jabber account IDs known to belong to cybercriminals which 
| obtained using public and proprietary sources including data mining aims to assist researchers 
vendors and organizations including U.S Law Enforcement on its way to properly track down 
and monitor including to prosecute the cybercriminals behind these campaigns. 


Sample XMPP/Jabber accounts IDs known to belong to cybercriminals and known to have been 
involved in various campaigns include: 


newjabber@jabbim.com 
cash@allinione.com 


Slark@jix.im 
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sypress@wwh.so 
soft-rdp@xmpp.jp 
merchant.official@xabber.de 
merchant.official@jabbim.com 
driesdtt@in.koderoot.net 
npaplav0O00k@strong.pm 
npaplavO0O0Ok@xmpp.jp 
cashsir@xmpp.jp 
luke@allinione.com 
nsky@allinione.com 
adm@allinione.com 
mrgreen@allinione.com 
tech@jabber.belnet.be 
jsminamr@openmailbox.org 
mrlapis@exploit.im 
airman@jabber.ru 
neshpiter@jabbim.com 
joke@blah.im 
westup@codingteam.net 
big@myempire.me 
Z@allinione.com 
cuclusclan@allinione.com 
mrgr@im.osmose-am.net 
maracana777@exploit.im 
daydate@im.apinc.org 
scratch@jabber.belnet.be 
cubon@thesecure.biz 
mate@creep.im 
nauthstuff@exploit.im 
dozer@jabb.im 
luke@suchat.org 
mainqmac@jabber.cz 
nadmin@pro-fi.net 
nspacetex@jabber.cz 
supp01@jabberx.biz 
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suppO8@xmpp.jp 
supp17@exploit.im 
supp37@cock.li 
puusycat@jabber.ru 
info@albfrrame.com 
nsupport _miloff@exploit.im 
nmilanol@default.rs 
aizoo-adv@thesecure. biz 
tmtforlifeqazbey@xmpp.jp 
greenman@jabber.belnet.be 
mikluchamaklai@jabb.im 
chromehearts@jabber.ru 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEivEP_yNCd8SV4chFiw8al1IS-8ZY7JJn_57hmMr YWT290B9 
otCf-qelSAfyodfXkRIpaQjYa95smyzQJf£TE1 JQQoxxXTD8xrIuYcyf 


1.7.8 Sample Personally Identifiable XMPP/Jabber Accounts of the Gozi/Ursnif Mal- 
ware Gang Team Members (2023-09-17 19:10) 


@@ 


[1] 


Digging a little bit deeper into my ongoing research into various personally identifiable infor- 
mation such as for instance email address accounts and XMPP/Jabber account IDs belonging 
to cybercriminals I’ve decided to share a compilation of XMPP/Jabber account IDs known to 
belong to the Gozi/Ursnif malware gang team members with the idea to assist researchers 
vendors and organizations including U.S Law Enforcement on its way to properly track down 
monitor and prosecute the cybercriminals behind these campaigns. 


Sample XMPP/Jabber account IDs known to have been involved in the campaign include: 
newjabber@jabbim.com 
cash@allinione.com 
Slark@jix.im 
sypress@wwh.so 
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soft-rdp@xmpp.jp 
merchant.official@xabber.de 
merchant.official@jabbim.com 
driesdtt@in.koderoot.net 
npaplav0O00k@strong.pm 
npaplavO0O0Ok@xmpp.jp 
cashsir@xmpp.jp 
luke@allinione.com 
nsky@allinione.com 
adm@allinione.com 
mrgreen@allinione.com 
tech@jabber.belnet.be 
jsminamr@openmailbox.org 
mrlapis@exploit.im 
airman@jabber.ru 
neshpiter@jabbim.com 
joke@blah.im 
westup@codingteam.net 
big@myempire.me 
Z@allinione.com 
cuclusclan@allinione.com 
mrgr@im.osmose-am.net 
maracana777@exploit.im 
daydate@im.apinc.org 
scratch@jabber.belnet.be 
cubon@thesecure.biz 
mate@creep.im 
nauthstuff@exploit.im 
dozer@jabb.im 
luke@suchat.org 
mainqmac@jabber.cz 
nadmin@pro-fi.net 
nspacetex@jabber.cz 
supp01@jabberx.biz 
suppO8@xmpp.jp 
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supp17@exploit.im 
supp37@cock.li 
puusycat@jabber.ru 
info@albfrrame.com 
nsupport _miloff@exploit.im 
nmilanol@default.rs 
aizoo-adv@thesecure. biz 
tmtforlifeqazbey@xmpp.jp 
greenman@jabber.belnet.be 
mikluchamaklai@jabb.im 
chromehearts@jabber.ru 


1. https: //blogger .googleusercontent .com/img/b/R29vZ2x1/AVvXsEhC4XKXNpzOfI9F- jGqMj 006TStm79t o6M3BYrnDVEPc_Uh 


9 JcKVHJfyPz1likgQX-rcx6Uy1lwboBPbTZmx41YrVNgvbxyTcYrxCI 


1.7.9 OSINT Round-Up of Russia-Based High-Profile Cybercriminals (2023-09-18 13:17) 


mee \ 


4) 
#4 Py 


[1] er ad 


In my line of work in specific when doing research and analysis | always stick to a common 
concept which has to do with the fact that “everything that can be found has already been 
found somewhere online”. Sticking to this basic methodology the only thing an individual or a 
researcher has to do is to look up the facts including all the relevant and necessary technical 
information on the individual or case they’re working on and basically come up with a proper 
analysis relying on publicly obtainable and publicly accessible information on their topic of 
interest. 


In this rather long OSINT analysis article I’ll do a OSINT roundup of Russia-based high-profile 
ransomware cybercriminals with the idea to share my research and analysis on the topic and 
potentially assist other researchers and vendors including U.S Law Enforcement on its way to 
properly track down and monitor and prosecute these cybercriminals. 
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wwwesendspace.com/file/yxhBau\nhttps 
www sendspace.com/delete/yxhbau/444f0b8a7b992a6376E 
www. sendspace.com/file?c5zSoc\nhttps 
wwiwesendspace. com/delete/ch2z9oc/5d625faSaae08tbeaab 
www. sendspace.com/file/Sr0280\\nhittps 
www. sendspace. com/delete/910280/9291 ad3ababd44586c¢ 
wiwia_sendspace. com/file/Ip2i5\nhttps 
Www. sendspace. com/delete/Iy2jr5/Ocabb38b684c95a41 8366 
Www. Sendspace: com/file/ekkhir\nhttps 
www. sendspace.com/delete/ekkhj/e/cbh1 di6ef9960227 #55 
www. sendspace.com/file/ihkxpis\nhttps 

[2] Wwww.sendspace. com/delete/ihkxpi/34be372eb03961 cadd7. 


\I’ll begin this analysis with an emphasis and actual OSINT research and analysis on the Conti 
Ransomware Group in the context of demonstrating what real-time OSINT is which a pretty 
good and decent methodology that I’ve been relying and using over the years which works. 


It all began with an internally leaked and made publicly accessible Conti Ransomware Gang’s 
internal communication where a security researcher or a set of security researchers appear to 
have compromised their internal server and have been collecting conversation logs between 
the cybercriminals which they later on made publicly accessible on Twitter in a specific for the 
purpose account that basically included direct download links to their internal communication. 


From an OSINT perspective the first thing a researcher should do is to do their best to obtain 
access to these conversation logs and attempt to preserve them for current and future use 
which is something that | did almost immediately considering the possibility to monitor and 
track down who the actual individuals behind this massive ransomware campaign are. 


The results? I’ve managed to successfully identify some of key individuals behind the Conti 
Ransomware Gang in terms of top management where my believe is that although it was a hired 
or outsourced “know-how” in the beginning quickly matured into a cybercrime enterprise where 
everyone who wanted to could join on a “franchise” based model and just do their work and 
earn fraudulently and maliciously obtained revenue from legitimate companies who are having 
their networks compromised and sensitive data and information made publicly accessible or 
basically encrypted in a way making it impossible for the actual organization and company to 
use. 


What is the Conti ransomware gang up to in terms of top management? It appears that the 
gang’s top management in a way is involved in the fashion industry with the idea that some 
of the screenshots that | obtained and processed and analyzed which were leaked internally in 
the form of exchange of URLs between the gang’s members lead me to believe that the gang 
is involved in either investing in fashion brands or actually working on such with several suc- 
cessful public OSINT analyses on the topic where I’ve managed to identify some of the fashion 
brands behind the Conti Ransomware Gang’s top management and my goal here is to present 
the actual findings with the idea to bring this fact to more light in the context of providing 
information on the activity of the Conti Ransomware Gang’s top management members. 


[3] 
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US, 


LUXURY PROMOTIONS 


PASSIONATE APOUT ELEGANCE 


GRES 


[8] 
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So basically once | came across their internal leaked communication made publicly accessible 
on Twitter | immediately aimed to obtain access to the leaked internal information of the Conti 
ransomware gang and preserve it before it goes online so that | can later on work with it and 
successfully produce the analysis including all the screenshots managed and operated by the 
Conti ransomware gang and here’s how | did it. 


Basically once | obtained access to their internal leaked communication which was made pub- 
licly accessible | data mined the internal leaked communication looking for personally identi- 
fiable email address accounts and related URLs with success which is where | automatically 
visited these URLs which | data mined in the Conti ransomware gang’s internal leaked commu- 
nication and basically grabbed all the live URLs information which is where the analysis and the 
screenshots including the actual report come from which | produced and have been working 
on to produce exclusively for fellow researchers and vendors including U.S Law Enforcement 
in order to assist everyone on their way to properly track down monitor and prosecute. 


Sample Internally Leaked URLs Courtesy of the Conti Ransomware Gang Obtained Using Public 
Sources 


There are several other fashion brand themed screenshots which | also managed to obtain 
which appear to be directly related to the Conti ransomware gang. 


Here are some of the “upcoming brands” courtesy of the Conti Ransomware Gang obtained 
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using real-time OSINT and relying on their internally leaked communications proving the gang 
including its top management is into fashion brands and the industry: 


Here’s some personally identifiable information on some of the brands using OSINT and public 
sources of information: 


[9] 


Leylo 


Top Management Includes: 


tel:+ 79126331303 


[10] 
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Mapua CepreeBHa Epmonaesa/Maria Ermolaeva (Chudnova) 
Birthday: 5 July 

hxxp://vk.com/id7326657 

Maria Ermolaeva 

Birthday: 5 July 

r. EkaTepuuH6oypr, yn. Penuna, 95, ocdbuc 116 

Tenepou: +7 (912) 633-13-03 

E-mail: info@leylo.ru 

leyloekb@gmail.com 

hxxp://leylo.ru/ 


[11] 
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Danil Ermolaev 


hxxp://vk.com/id4874860 


Birthday: 7 August 1989 


Sample Top Management Photos and Personally Identifiable Information of the Conti Ran- 
somware Gang’s charity fund: 


[12] 
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Tamila Kerimova 

Conti Ransomware Gang’s Top Management Team 
hxxp://impulse-life.ru 

Tamila Kerimova 

— Birthday: 4 April 1986 

— hxxp://vk.com/id6515862 

— Planet for beauty and development 

— hxxp://irinaverhusha.com 

Ten: +7 926 536-63-68 

Email: impulse. life2020@gmail.com 


Sample Internally Leaked Screenshots Courtesy of the Conti Ransomware Gang: 
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Sample Conti Ransomware Gang’s Internal Leaked Screenshots 


Sample Related Internally Leaked Screenshots Courtesy of the Conti Ransomware Gang: 


Sample Conti Ransomware Gang’s Internal Leaked Screenshots 
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[15]° 


[16] 


[17] 
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[20] 
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Sample Conti Ransomware Gang’s Internal Leaked XMPP/Jabber Account IDs: 
LiamNeeson@jabber.ru 
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arb _reserved@ubuntu-jabber.de 
battletoad@jabbim.sk 
begemot sun@jabber.ru 
crazy digger@jabber.ru 
gfh6776@jabb.im 
ivanalert@jabber.ru 
landslide@jabb.im 

new _henry@jabber.cz 
scopehope@jabb.im 
ugly@1jabber.com 
valeriuS2k@jabber.ru 
vdx17@jabber.ru 
337788@exploit.im 
asteradminn@sure.im 
benalen@exploit.im 
bio@yax.im 
crunch@exploit.im 
daiverjm@exploit.im 
dmanager@exploit.im 
fuckUSAhahaha@exploit.im 
fuckusa@exploit.im 
gfh6776@jabb.im 
goldcoin@exploit.im 
jackiedugn@exploit.im 
landslide@jabb.im 
martiniden123@exploit.im 
mr _loki@exploit.im 

posi tron@exploit.im 
pravdazanami@exploit.im 
rob0660@conversations.im 
scopehope@jabb.im 
soulst@exploit.im 

time t@exploit.im 
trqa23rt@exploit.im 
volhvb@exploit.im 
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yastreb@exploit.im 
SamCodeSign@xmpp.jp 
alieelu@xmpp.jp 
baton@xmpp.jp 
batono@xmpp.jp 
benalien@xmpp.jp 
cosm123@xmpp.jp 
graddds@xmpp.jp 
guliver@xmpp.sh 
liamliam@xmpp.jp 
ohmygod728@xmpp.jp 


[23] 


FAV WW 


Your network has been infected by Avaddon 


- What's the matter? 


Your computer has been infected with 
Avaddon Ransomwere, All your files have 
been encrypted and you are not able to to 
decrypt it by yourself, To decrypt your files 
you have to bay Avaddon Decryptor 


-What guarantees 
can you give me? 


To be sure we have the decryptor and it 
works you uve free decrypt and decrypt 
one file for free. But this file must be an 
image .because images usually are not 
valuable 


Wea Beare) Bs Qin 


- What can i do to 
get my files back ? 


You should buy your software Avaddan 
Decryptor, It will scan your PC. network 
share, all connected devices and chock for 
encrypted and decrypt it, Current price: 
1000 USD. We accept cryprocurrency 
Bitcoin 
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MR. SCARFACE 
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AO WOGOTO TKORIE 


yxamnnaTs 300 


KOMMEHTAPHKM 


o & li F333 
wr 


oner, o 


? 


4 6 7 8&8 8$ TSO} 


ANANER HOOK 
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r~ 
Boi DEUCE VIPAK GES 
¢ PEK/IAMbI 


¥ LPysew 


NOAYYARTE 5 X10 GObUIE ONDMTA, KOTAA BbI 
HAXOAMTECh HA YPOBHE, ZAKAHNMBAIOULEMCE HA 0 
{HATIPHME?P, 10, 20, 30 . 150 1 TAK MANES) M X2 PASA 
GO/ILIE ONLITA, KOTAA BLI HAXOAMTECE HA JIOBLIX 

APYTMX YPOBHAX B TEYEHHE CPOKA REACTBMA 
SOHYCA.NONYUAATE B X10 BODIE OFMTA, KOTAA Bb 

HAXOAMTECE HA YPOBHE, SAKAMYMBAIOULEMCR HA 0 
(HAMPUMEP, 10, 20, 30 . 350 HW TAK AAAES) XZ PASA 

GONbWE ONDITA, KOTAA Bhi HAXOAMTECS HA HIOBRIX 

APYTMX YPOBHAX 8 TEVEHME CPOKA AEVCTEMA 

BSOHYCA.TIOSYUAATE 8 X10 BOJIBUIE OTILITA, KOTAA Bhi 
HAXOAMTECD HA YPOBHE, ZAKAHNMBAIOUIEMCR HA 0 
{HAMPMMEP, 10, 20, 30... 150 TAK JAJIES) WX? PABA 
BOALUIE ONLITA, KOTAA Bhi HAXOAMTECL MA FIOBLIX 

APYTUX YPOBHAX 8 TEYEHME CPOKA AEACTAMA 
BOHYCA., 


[26] 


[27] 


hetckan onexga 


Denis Gennadievich Kulkov 


Personal Photo of Denis Gannadievich Kulkov 
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[28] 


Among the actual domains known to be part of the Try2Check cybercriminals enterprise in- 
clude: 


hxxp://try2services[.]pm 
hxxp://try2services[.Jcm 
hxxp://try2services[.]vc 
including the following domain: 
hxxp://just-buyf[. Jit 


including the following two ICQ numbers 855377 and 555724 and let’s don’t forget his personal 
email address accounts obtained using public sources which are polkas@bk.ru nordexin@ya.ru 


© © © 
© © 
[29] noha ee 


and it doesn’t get any better than this as we’ve got a pretty good and informative domain port- 
folio registered by the same individual based on public information sharing the same domain 
registration details such as for instance hxxp://worldissuer[.]biz which actually are: 
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hxxp://cloud-mine[.]me 
hxxp://gpucloud[.Jorg 
hxxp://hyperhost[.]info 
hxxp://miservers[.]info 
hxxp://carterdns[.]Jcom 
hxxp://reshipping[.]us 
hxxp://keyserv[.]org 
hxxp://antmining[.]biz 
hxxp://investmentauditor[.]com 
hxxp://sunnylogistics[.]us 
hxxp://try2services[.]cm 
hxxp://greatwallhost[.]net 
hxxp://jaqjckugrfffqa[.]Jcom 
hxxp://numberoneforyoul[.]net 
hxxp://getprofitnow[.]biz 
hxxp://avsdefender[.]Jcom 
hxxp://spyware-defender[.]Jcom 
hxxp://beta-dns[.]net 
hxxp://mpm-profit-method[.]com 
hxxp://public-dns[.]Jus — related including this 


[30] 


hxxp://adobe-update[.]Jnet — Email: krownymaradonna@onionmail.org related domains 
known to have been involved in the campaign include — hxxp://amazon-clouds[.]com; 
hxxp://microsoft-clouds[.]net; hxxp://telenet-cloud[.]Jcom; hxxp://vmware-update[.]com 
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[31] 


= ., 
hxxp://kwitri[.]net 
hxxp://dcm-trade[.]com 
hxxp://karoospin[.]biz 
hxxp://fastvps[.]biz 
[32] 


6 © ¢6 8 


Evgeniy Mikhaylovich Bogachev 


[33] 


Sample Personal Photos of Evgeniy Mikhaylovich Bogachev: 


[34] 
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Slavik’s IM and personal email including responding IP: 
bashorg@talking.cc — 112.175.50.220 

Personal Address: 

Lermontova Str. Anapa, Russian Federation 

Instant Messaging account: 

lucky12345@jabber.cz 

Related name servers: 

ns.humboldtec.cz — 88.86.102.49 

ns2.humboldtec.cz — 188.165.248.173 

Related domains part of a C &C phone-back location: 
hxxp://slaviki-resl.com 

hxxp://slavikl.com — 91.213.72.115 
hxxp://slavik2.com 

hxxp://slavik3.com 

Slavik’s primary email: 

luckycats2008@yahoo.com 

Slavik’s ICQ numbers: 

ICQ — 42729771 

ICQ — 312456 

Related emails known to have participated in the campaign: 
alexgarbar-chuck@yahoo.com 
bollinger.evgeniy@yandex.ru 
charajiangl16@gmail.com 

Related domains known to have participated in the campaign: 


hxxp://visitcoastweekend.com — 103.224.182.253; 70.32.1.32; 192.184.12.62; 141.8.224.93; 
69.43.160.163 


hxxp://incomeet.com — 192.186.226.71; 66.199.248.195 
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hxxp://work.businessclub.so 

Real Name: Galdziev Chingiz 

Related domains known to have participated in the campaign: 
hxxp://fizot.org 

hxxp://fizot.com — 50.63.202.35; 184.168.221.33 

hxxp://poymi.ru — 109.206.190.54 

Related name servers known to have participated in the campaign: 
ns1.fizot.com — 35.186.238.101 

ns2.fizot.com 

Related domain including an associated email using the same name server: 
hxxp://averfame.org — harold@avereanoia.org 

Google Analytics ID: UA-3816538 

Related domains known to have participated in the campaign: 
hxxp://awmproxy.com 

hxxp://pornxplayer.com 

Related emails known to have participated in the campaign: 
fizot@mail.ru 

xtexgroup@gmail.com 

xtexcounter@bk.ru 


Related domains known to have responded to the same malicious and fraudulent IP — 
178.162.188.28: 


hxxp://dnevnik.cc 
hxxp://xvpn.ru 
hxxp://xsave.ru 
hxxp://anyget.ru 
hxxp://nezayti.ru 
hxxp://proproxy.ru 
hxxp://hitmovies.ru 
hxxp://appfriends.ru 
hxxp://naraboteya.ru 
hxxp://naraboteya.ru 
hxxp://awmproxy.com 
hxxp://zzyoutube.com 
hxxp://pornxplayer.com 
hxxp://awmproxy.net 
hxxp://checkerproxy.net 
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Related domains known to have participated in the campaign: 
hxxp://fizot.livejournal.com/ 

hxxp://russiaru.net/fizot/ 

Instant Messaging Account: 

ICQ — 795781 

Related personally identifiable information of Galdziev Chingiz: 
hxxp://phpnow.ru 

ICQ — 434929 

Email: info@phpnow.ru 

Related domains known to have participated in the campaign: 
hxxp://filmv.net 

hxxp://finance-customer.com 

hxxp://firelinesecrets.com 

hxxp://fllmphpxpwqeyhj.net 

hxxp://flsunstate333.com 

Related individuals known to have participated in the campaign: 


Slavik, Monstr, 1OO, Nu11, nvidiag, zebra7753, lexa_Mef, gss, icelX, Harderman, Gribodemon, 
Aqua, aquaSecond, it, percent, cp01, hct, xman, Pepsi, miami, miamibc, petrOvich, Mr. ICQ, 
Tank, tankist, Kusunagi, Noname, Lucky, Bashorg, Indep, Mask, Enx, Benny, Bentley, Denis 
Lubimov, MaDaGaSka, Vkontake, rfcid, parik, reronic, Daniel, bx1, Daniel Hamza, Danielbx1, 
jah, Jonni, jtk, Veggi Roma, D frank, duo, Admin2010, h4xOrdz, Donsft, mary.J555, susanneon, 
kainehabe, virus e 2003, spaishp, sere.bro, muddem, mechanizm, vlad.dimitrov, jheto2002, 
sector.exploits 


Related Instant Messaging accounts and emails known to have participated in the campaign: 
iceix@secure-jabber.biz 
shwark.power.andrew@gmail.com 
johnlecun@gmail.com 
gribodemon@pochta.ru, 
glazgo-update-notifier@gajim.org 
gribo-demon@jabber.ru 
aqua@incomeet.com 
miami@jabbluisa.com 
um@jabbim.com 
hof@headcounter.org 
theklutch@gmail.com 
niko@grad.com 
Johnny @guru.bearin.donetsk.au 
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petrOvich@incomeet.com 
mricq@incomeet.com 
T4ank@ua.fm 
tank@incomeet.com 
getreadysafebox.ru 
john.mikleymail.com 
alexeysafinyahoo.corn 
rnoscow.berlin@yahoo.com 
cruelintention@email.ru, 
bind@ernail.ru 
firstmen17@rarnbler.ru 
benny@jabber.cz 
airlord1988@gmail.com 
bxl@hotmail.com 

i _amhere@hotmail.fr 
daniel.h.b@universityofsutton.com 
princedelune@hotmail.fr 
bxl_@msn.com 
danibxl@hotmail.fr 
danieldelcore@hotmail.com. 
d.frank@jabber.jp 
d.frank@Online.at 
duo@jabber.cn 
fering99@yahoo.com 
secustar@mail.ru 
h4x0rdz@hotmail.com 
Donsft@hotmail.com 
mary.j555@hotmail.com 
susanneon@googlemail.com 
kainehabe@hotmail.com 
virus e€ 2003@hotmail.com 
spanishp@hotmail.com 
sere.bro@hotmail.com 
lostbuffer@hotmail.com 
lostbuffer@gmail.com 
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viad.dimitrov@hotmail.com 
jheto2002@gmail.com 
sector.exploits@gmail.com 
Aleksei Belan 


[35] 
Sample Personal Photo of Aleksei Belan 
Sample domains known to have been involved in the campaign: 


177653558 14h com Imey yuwke pret com 
} 
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194. 12.40 ta> WWSS4VIFIID 106 1641 343 BIEN #2 78,190,628 S50.25.19 TE AI UBEIZIS 
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Sample personally identifiable email address accounts known to have been involved in the 
campaign: 


moy.yawik@gmail.com 

moy-yawik@bk.ru 

Sample known responding IPs known to have been involved in the campaign include: 
77.221.159.235 

62.76.182.72 

62.76.190.68 

185.50.25.13 

104.18.41.143 

198.54.117.212 

104.18.40.143 


Mykhaylo Sergiyovich Rytikov 


[37] 


Sample Personal Photo of Mykhaylo Sergiyovich Rytikov 
Known domains affiliated with AbdAllah Internet Hizmetleri: 
hxxp://tiket[.]cc 

hxxp://abdullal.]cc 


hxxp://privateforum[.]cn —_— upomajuliya745@gmail.com; xpj88kf@gmail.com; 
316411856@qq.com 


[38] 
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Related known domains affiliated with AbdAllah Internet Hizmetleri: 
hxxp://ns1[.]srv4u[.]biz 

hxxp://bulletproof-service[.]com — Email: support@hosting-offshore.biz — 202.83.212.250 
hxxp://tarahost[.]net — Email: konstantin@karyaev.com — 89.108.73.93 


[39] 


ae 


31841 1888@qq.com 


® ® ® 


gurtumean.cn ecty007.cn bye360.cn 


3 oy oy 


cd1bSbSSeS4sSccibadcd43cSizassadt et ffedef22dds22809b4abe+S320Sabf dcZaffoSs0 34dei Sidi t6|eS7TI5657ee 


Related domains known to have been registered by the same domain registrant: 
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hxxp://all-mafia[.]net 
hxxp://shampanskoe[. Jinfo 
hxxp://mashost[.]org 
hxxp://flexi-domains[.]com 
hxxp://5pagess[.]net 
hxxp://extrasoft[. ]biz 
hxxp://golovolomka[.]info 
hxxp://optical-coatings[. info 
hxxp://polevoil. info 
hxxp://belorussia[. ]info 
hxxp://3alab[.Jcom 
hxxp://prezervativ[.Jorg 
hxxp://brodyaga[.]net 
hxxp://skramedia[.]com 
hxxp://tarafree[.]Jcom 
hxxp://mp3-mmf[.Jcom 
hxxp://myproga[.]net 
hxxp://extrahost[.]su 
hxxp://garanthost[.]Jcom 
hxxp://grand-host[.]net 
hxxp://technormativ[. info 
hxxp://xp-hosting[.]net 
hxxp://kredits[.]cn 
hxxp://tarahost[. ]biz 
hxxp://tarahost[.lorg 
hxxp://optical-coatings-design[. info 
hxxp://extrasoft-outsourcing[.]info 
hxxp://pm-tost[.]net 
hxxp://pm-sotovik[.]net 
hxxp://pm-ranlix[.]net 
hxxp://pm-holland[.]net 
hxxp://swlu[.]info 
hxxp://valdiss[.]info 
hxxp://karyaev[.]com 
hxxp://x450[.Jinfo 
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hxxp://grand-host[.]biz 
hxxp://flexi-classifieds[.]Jcom 
hxxp://flexi-sitebuilder[.]Jcom 
hxxp://flexi-projects[.]com 
hxxp://bloggast[.]info 
hxxp://pereezd-pro[.]info 
hxxp://eduaction[.]info 
hxxp://wmnakovalnya[.]Jcom 
hxxp://retro80x[.]com 
hxxp://tarafree[.]net 
hxxp://skramedial[.]org 
hxxp://oldactors[.]net 
hxxp://tarahost[.]net 
hxxp://janimation[.]net 
hxxp://tarahost[.]Jcom 
hxxp://skramedia[. ]biz 
hxxp://vv-want[.]info 
hxxp://skramedia[.]net 
hxxp://olimp-sport[.]com 
hxxp://youhouse[. ]biz 
hxxp://kroleki[.]Jcom 
hxxp://extrasoft-projects[.Jinfo 
hxxp://zelenaya[.]com 
hxxp://cazinowm[.]Jcom 


hxxp://extrasoft-outsourcing[.]net 


[40] 
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—— @ 


xpjSSkiGigmelt.com 


san Zant 
&) @) 
yuenii.com Tbbs-cn 


STeeloches5b$ s02=824ficehctss5 1b c039scfb7b0e053745l') eddfda0 52031 


Related domains known to have been involved with AbdAllah Internet Hizmetleri: 
hxxp://magic-jackpot-cas[.]com 
hxxp://euro-vip-casino[.]com 
hxxp://royal-casino-vip[.]com 
hxxp://sexrusfuck[.]Jcom 
hxxp://royal-cas-vip[.]com 
hxxp://2400-usd-casino[.]com 
hxxp://royalcasino-vip[.]com 
hxxp://2400usd-casino[.]net 
hxxp://eurocasino-vip[.]com 
hxxp://sinlife[.Jcn 
hxxp://byron-consulting-group[.]Jcom 
hxxp://28-07[.]com 
hxxp://28-07[.]net 
hxxp://job-consults[.Jorg 
hxxp://837-86[.]org 
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hxxp://expressdeal[. ]biz 
hxxp://cron[. ]li 
hxxp://crons[.]cc 
hxxp://cronos[.]mn 
hxxp://crinc[.]mn 
hxxp://crinc[. Jli 
hxxp://ultrasmoke[.]cn 
hxxp://supersmoke[.]cn 
hxxp://globalsmoke[.]cn 
hxxp://937-86[.]org 
hxxp://cronco[. ]li 


hxxp://tradegroup-ha[.]Jcom 
hxxp://ha-tradegroup[.]com 


hxxp://crinc[.]jp 


hxxp://tradegroup-ha[.]net 


hxxp://investmentcron[.]cn 


hxxp://glb-soft[.]Jcom 
hxxp://croninv[.]cc 
hxxp://cronis[.]cn 
hxxp://crons[.]Jac 
hxxp://cronn[.]eu 
hxxp://dkebooks[.]com 
hxxp://cronoil[.]cc 
hxxp://jieod[.]Jcom 
hxxp://midgejs[.]com 
hxxp://crin[. Jac 
hxxp://aoejf[.]com 
hxxp://yseac[.]Jcom 
hxxp://kaserid[.]com 
hxxp://crin[.]cc 
hxxp://jekdoe[.]Jcom 
hxxp://ujeose[.]Jcom 
hxxp://masiwer[.]com 
hxxp://reusiwe[.]com 


hxxp://kaoeds[.]Jcom 
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hxxp://iwoser[.]Jcom 
hxxp://planetOday[.]biz 
hxxp://xeirod[.]com 
hxxp://neusoas[.]com 
hxxp://geoepd[.Jcom 
hxxp://efuyr[.]Jcom 
hxxp://ziude[.]Jcom 
hxxp://polsenstanford[.]com 
hxxp://heyud[.]com 
hxxp://wogkr[.]Jcom 
hxxp://seiudr[.]com 
hxxp://aosier[.]com 
hxxp://dueor[.]com 
hxxp://crins[.]Jac 
hxxp://verbespecially[.]Jcom 
hxxp://fivejoy[.]Jcom 
hxxp://riverwomen|[.]com 
hxxp://trianglesentence[.]Jcom 
hxxp://floorside[.]Jcom 
hxxp://developtail[.]Jcom 
hxxp://womanfinish[.]com 
hxxp://alwaysfell[.]com 
hxxp://differcollect[.Jcom 
hxxp://goodalso[.]Jcom 
hxxp://kingbrought[.]com 
hxxp://findcharacter[.]Jcom 
hxxp://chanceexpect[.]com 
hxxp://beardictionary[.]com 
hxxp://forwardfield[.Jcom 
hxxp://tinydown[.]com 
hxxp://jobwhether[.]com 
hxxp://numeralcity[.]Jcom 
hxxp://cronin[. ]jp 
hxxp://equalcatch[.]com 
hxxp://streamwho[.]com 
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hxxp://selectmonth[.]Jcom 
hxxp://propercame[.]com 
hxxp://grewsoil[.]com 
hxxp://townslip[.]Jcom 
hxxp://stationheavy[.]com 
hxxp://charactereven[.]Jcom 
hxxp://milkOsoft[.]Jcom 
hxxp://goldverb[.Jcom 
hxxp://windowlisten[.]com 
hxxp://bqgqnfc[.]cn 
hxxp://wrbhnuwl[.]cn 
hxxp://a9da6[.]org 
hxxp://04ccc408[.]Jorg 
hxxp://bdb7beb6[.]lorg 
hxxp://scalespread[.]Jcom 
hxxp://thencloud[.Jcom 
hxxp://figurespoke[.]com 
hxxp://fullfraction[.]com 
hxxp://propertytall[.Jcom 
hxxp://beautyfig[.]Jcom 
hxxp://nadover[.]com 
hxxp://followsalt[.]com 
hxxp://staysay[.]Jcom 
hxxp://herexcept[.]Jcom 
hxxp://thanscore[.]Jcom 
hxxp://nhumanthus[.]Jcom 
hxxp://branchfelt[.]Jcom 
hxxp://areacountry[.]com 
hxxp://meetduring[.]Jcom 
hxxp://movestood[.]com 
hxxp://stillverb[.]Jcom 
hxxp://suggesteye[.]Jcom 
hxxp://preparebut[.]Jcom 
hxxp://hurrysound[.]Jcom 


hxxp://cookcompare[.]Jcom 
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hxxp://Odaycod[. ]biz 
hxxp://europeansmoke|[.]cn 
hxxp://sprybog[.]net 
hxxp://taybaol[.]Jcom 
hxxp://polsenstanford[.]com 
hxxp://bconsgroup[.]Jcom 


GRU’s Unit 74455 “NotPetya” 


[41] 
URL 
IP: Sd PTR: 
Geol = AMAZO) 
URL; 
Ip: Pie 
eolp: = iA 
URL: 
iP 1 PTR: 
p= é IN J 
URL 
IP: 22 - PT 
GeaulP:® AM, J 
URL: { 
IP: PIR 
BoiP: MBs IS - AS24158 (AMAZON-A ES- 4 


Sample screenshots of the GRU’s Unit 74455 “NotPetya” malware gang obtained using public 
sources: 
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[43] 
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contact_tmtisny@teemal|ime 


um 10esetnat 2523-updater-sym anieac oro 


[44] 


jada chee 158m ail com 


Generalsecuritycorp.org = feservecorpind.com 


[45] 


Matioy@openm ailboxorg 


~ 


mvsband.com madversion vet 


[46] 


1517 


1518 


healthkeeping org 


[47] 


[48] 


[49] 


[50] 


[51] 
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[52] 


[53] 


[54] 
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[55] 


[56] 
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Igor Dehtyarchuk 
1522 


[60] 


Sample Personal Photo of Igor Dehtyarchuk 


Sample emails known to have been involved in the campaign include: 


abuse@shopsn.su 
dimetr801@mail.ru 
admin@4server.su 
ssg.apple77@gmail.com 


‘eo 
a - 
4senersu 


a 


@) 


ebayshopisu 


@ 
cjmaket.net 
@ 


host.su 


osgoaec. 


®) 


globusbase.st 


®& 


vkaocounts,com 


qs) 


tgshop.su 
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®) 


mathetsales.su 


OF 


hroshopisu 


cheapaccounts.su 


—. 
4ins.su 


zarmo.su 
am, 


@®) 


deet.su 


sank 
@®) 


ytubersu 


_ 
@®) 


4dedicsu 


(S) 
8 
Sdomainssu 


P+. 
®) 
sh ine 
© 
) 
lees 
a 
) 
© 


time-hack.su 


Sample domains known to have been involved in the campaign include: 


hxxp://4server.su 
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hxxp://csgoacc.ru 
hxxp://marketsales.su 
hxxp://zarmo.su 
hxxp://4domains.su 
hxxp://ebayshop.su 
hxxp://globus-base.su 
hxxp://broshop.su 
hxxp://deer.su 
hxxp://shopsn.su 
hxxp://cjmarket.net 
hxxp://vkaccounts.com 
hxxp://cheapaccounts.su 
hxxp://ytuber.su 
hxxp://vds4u.su 
hxxp://4host.su 
hxxp://tgshop.su 
hxxp://xn — 227-qdd4dec.xn — placf 
hxxp://4dedic.su 
hxxp://time-hack.su 
hxxp://4ns.su 

Sample screenshot: 


Oleksandr Vitalyevich leremenko 


[62] ew 


Sample Personal Photo of Oleksandr Vitalyevich leremenko 
Handle: Zl0m; Lamarez; Ded.MCz; |@m@rEz 


Email: lamarez@mail.ru; uaxakep@gmail.com — xeljanzusa.com — 62.109.25.228 
(hxxp://www.secureworks.com/research/point-of-sale-malware-threats); 62.109.1.69 


Commpany: 2016 K3epoxkc 
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Phone: +7 951 36617 17 


ICQ: 123424 


Web Money: 258807111393 


Related URLs: 


hxxp://ageline.ru/lamarez.php 
hxxp://kOx.ru/md5.salt.tx 

hxxp://kOx.ru/ _bot.exe — 82.146.60.59 
hxxp://kOx.ru/black energy 31337 /stat.php 
hxxp://kOx.ru/siicywu36dswh/addddos.php 


hxxp://xtoolz.ru 
hxxp://cup.su 


hxxp://xwarez.us 


hxxp://kinoafisha.ua/news/lamarez-was-here 


hxxp://post-tracker.ru 


hxxp://zr.ru 


hxxp://business-gazeta.ru 


hxxp://proshkolu.ru 
hxxp://opengost.ru 
hxxp://krokha.ru 
hxxp://eurolab.ua 
hxxp://newsdon. info 
hxxp://dirt.ru 
hxxp://anime-zone.ru 
hxxp://rus.kg 
hxxp://badger.ru 
hxxp://fedpress.ru 
hxxp://carsguru.net 
hxxp://findfood.ru 
hxxp://beboss.ru 
hxxp://vidal.ru 
hxxp://reghelp.ru 
hxxp://rabotagrad.ru 
hxxp://proshkolu.ru 
hxxp://muztorg.ru 


hxxp://mirf.ru 
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hxxp://medgorodok.ru 
hxxp://dobrota.ru 
hxxp://cooksa.ru 
hxxp://consmed.ru 
hxxp://buro247.ru 
hxxp://3dmir.ru 
hxxp://novorus.info 
hxxp://kidbe.ru 
hxxp://eknigi.org 
hxxp://2*2.su 

Exante LTD — XNT Ltd. — exante.eu 
Danil Potekhin 


[63] 
Sample personal Web site: hxxp://agressivex.com 


[64] 


Aqressivex AndraBat 


Login 


Sample personal email: potekhinl4@bk.ru 

Sample MD5 known to have participated in the campaign: 

MD5: ecb347518230e54c773646075e2cc5ea269dcf8304ad102cee4aae75524e4736 
Happy research! 
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1.7.10 Exposing the Bulgarian Cyber Army Cyber Threat Actor (2023-09-18 13:28) 


[1] 


Anonymous Bulgaria is your typical Anonymous “franchise” Anonymous hackers model where 
you have a group of people doing web site defacements and compromises of legitimate web 
sites and infrastructure and actually blame a bigger cause that they don’t really have anything 
to do with and don’t understand or know anything about it. 


The ultimate goal here would be for the group to gain momentum including to attract followers 
where the ultimate goal would be to spread a message that they don’t often understand or 
have anything to do with low profile DDoS attacks or cyber attack attempts similar and typical 
to the Anonymous hackers collective idea. 


Is it script kiddies or low profile wannabe hacker groups that basically have one social media 
account and are capable of launching low profile cyber attack attempts that often make the 
news or is it a bigger conspiracy where everyone doing the same can outsource their respon- 
sibility for doing it to the entire “idea” which basically represents an Anonymous set of people 
attempting to do low profile cyber attack attempts? 


[2] 
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Son of a bitch! 
Where’s My Page? 


‘i= 


Click here to ge soriowhere vier 


It soins ike this Ongu uses JavaScrpticode thut-conficts with Ruffle 


Let’s go for the first part. 


The important part when dealing with this type of low profile threat actor is to usually keep 
track of their activities including social media profiles and activity and look for additional clues 
in terms of current and ongoing cyber attacks and most importantly look for additional clues 
such as personally identifiable information which would be later on used in a possible cyber 
threat actor attribution campaigns including for the actual enrichment of this PII for the purpose 
of looking for additional clues in terms of doing threat actor infrastructure reconnaissance 
on your way to look for additional clues such as related malicious and fraudulent including 
cybercrime activity including domains personally identifiable email address accounts or related 
social media accounts. 


BgWorm 


[3] 


The ultimate goal when collecting these would be yo either build a database of the threat actor 
in question which could lead to a possible commercial or community driven project venture 


1531 


or to assist fellow researchers and Law Enforcement on its way go track down monitor and 
prosecute these individuals. 


[4] 


In this article I’ll discuss in-depth the Anonymous Bulgaria hacker franchise that basically just 
like many other Anonymous franchises across the globe basically represent low profile cyber 
attack attempts type of threat actors and will provide personally identifiable information on 
their online whereabouts. 


[5] 
1532 


Some of the other Bulgarian Web site defacement groups that are known to work and coop- 
erate with Bulgarian Cyber Army include BG Worm, MTH Soft, Hack3D TeaM and EvilHack and 
Anonymous Bulgaria. 


[6] 
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What's specifically interesting about Bulgarian Cyber Army is that the group appears to be still 
and currently active and operational based on some of their latest web site defacement and 
Facebook activity. 


Personally Identifiable Information on Bulgarian Cyber Army: 
hxxp://facebook.com/hack3dteam 
hxxp://vimeo.com/user16145338/videos 

Personally Identifiable Information on Hack3d Team: 
MaStErHaCk 

Slackera 

Tiger 

RTFM 

Sspdf11 


Pantelix 
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razora911 

Personally Identifiable Information on EvilHack: 
EvilHack[.]Jhmamail.com 

anonyops[.]abv.bg 

genadi _100[.]abv.bg 

evil hack[.Jabv.bg 

evilhack[.]bk.ru 

evilhackOOO[.]gmail.com 

clangrf[.Jabv.bg 
hxxp://anonymous-world.free.bg 
hxxp://web-dangerous.free.bg 
hxxp://evilhack-official.blogspot.com/ 
Personally Identifiable Information on Anonymous Bulgaria: 


NoTolerance 


hxxp://anonbg.info 


_bvtpa:/ologger googleusercontent.con/ing/a/AV is cOleu~924P Vans 2eNPENPPR ai Ek CaSp2Lual20q7 S156) 
3. https: //blogger .googleusercontent . com/img/a/AVVXsEiqS-x_vt6XN9xtg-bGSBj 5DdHBUV52JeN3pytESKDM_nyIOJErSVjVZV 
4. https:/ blogger. googleusercontent.con/ing/a/AVvisEs Ala-FYJNcdSoBysadFalSssea_OFghj Aud FigeIFaKel_pOF 
5. lctps:/ logger .googleusercontent .con/sng/a/ AV sEgyRFAUgHAAOESELegkDSToSIQEg@2#MbnZ00}- cebLTvirayAolPqCsdd 
6. hictps:/ologger .googleusercontent .con/sng/a/ AV sEgpcETINf@PGp52SHuShF 6p Jou IR TaOYALTohGSiSD5is-Yaghol 
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1.7.11 Applying for the Rewards for Justice on the Conti Ransomware Gang Program 
(2023-09-18 21:08) 


[1] 


Dear blog readers, 


This is Dancho and | have some news. | just applied for the United States Rewards for Justice 
program on the Conti Ransomware Gang and | identified myself with my research and analysis. 


[2] 
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Rewards_ForJustice_Dancho_Danchey_Conti_Ransamware_Gang_Bitzlate_Cryptocurrrency_Exchange_OSINT_Phatos_2023_01 
Rewards_For_lustice_ Dancha_Danchey_Conti_Ransomware_Gang_Fashion_Brands_Photos_2023 01 
Trickbot_Gang_Sanctions_OSINT Analysis Photos_2023_01 
Trickbot_Gang_ Sanctions_OSINT Analysis Photos_2023. 02 
Trickbot_Gang_Sanctions_OSINT_ Analysis Research 2023 0 
= Rewards_Forlustice_Dancho_Danchey_Conti_Ransomware_Gang_Email Address Accounts_2023_01 
Ga Rewards_For_Justice_ Dancha_Danchev_Conti_Ransomware_Gang_In_Depth_OSINT Analysis 
= Rewards_ForJustice_ Dancho_Danchey Canti_Ransomware_Gang_Internal_Leaked_URLs_Compilation_2023_01 
= Rewards_For_Justice_Dancho_Danchev_Conti_Ransamware_Gang_XMPP_JabberAccount_IDs_2023_01 
a Rewards_For_Justice_ Dancha_Danchey_STIXCSTIx2_loC_Conti_Ransomiware_Gang_01 
Rewards_For_lustice_Dancho_Danchev Tickbot_Gang_Bitzlato_Ciyptocurrency_Exchange_OSINT_Analysis 
=] Rewards_For_lustice Dancho_Danchev_Trickbot_Gang_Emall_Address_Accounts_2023._01 
Rewards_Forlustice_Dancho_Danchey_Trickbot_Gang_In_Depth_OSINT Analysis 
8 Rewards_ForJustice Tickbot_Internal_Leaked Chats 2023.01 
8 Rewards For Justice Trickbot Internal_Leaked Comrmunication_Profiles_ 2023.01 


Wish me luck. 
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Stay tuned. 


1, fittps://blogger. googleasercontent,con/ing/a/AVvks8 j2Ki@pLTTHKTyDtZHiGFStaF HRSilgyOk_DIL4_bO-LiDy2Viodz 
2, https: / blogger .googleusercontent.con/ing//AVvXsEi j6F-Red_iuet01Pin21TGy PL YgEnke--BGuval YkoSbskerqy 
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1.7.12 Yavor Kolev - Part Two (2023-09-18 21:39) 


Dear blog readers, 


Are you in a desperate need to reach out to someone who's basically the exact definition of 
a toilet person? Is it the taste or is it the smell? Is it the desperate need or the promise for 
something cool and interesting? 


Let’s start from the basics by defining the terms. Just what exactly a toilet person is? A toilet 
person but correct me if I’m wrong since | don’t mean to be weird knowing this is someone 
supposedly thinking that first of all the toilet is a cool thing and most of all since the person 
is Supposedly thinking he’s also cool he should either buy a toilet or live and work there. In a 
toilet? A toilet through the perspective of a toilet person is an entire universe and let’s don’t 
forget a supposedly something that although he wouldn’t understand at the beginning an entire 
dimension. 


A second logical question emerges? Is the very bottom of your pathetic and moronic existence 
and should the very spitness and social vomitness of your irrelevant social existence set an 
example for others? 

The answer is no. 


Stay tuned! 


1. https://blogger .googleusercontent .com/img/a/AVvXsEhzIp-Rf YWpOhPSgZxWBw3YausW2mP4boSmkyC8Uce35cpNEuWMpa2Ga 
yh9GIvH3GCkU2-RrbpZBleRXLX- X- 5WLezQ1-O0JOVhOnDc-Hv4Ux 
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1.7.13 A New DIY Grim Android Botnet Spotted in the Wild (2023-09-19 00:45) 


[1] 


| just came across to a newly released DIY Android Botnet with some pretty interesting built-in 
features including the use of mobile-based ransomware device locking capability including to 
offer the attacker the capability to take full control of the Android device for various purposes. 


Sample screenshots: 


[2] 
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[4] 
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Ridden SMS interception works from 5 to above. 

Injections work on all current versions 5 - 10, 

The data between the servers and the bot is encrypted. 

Bot deletion blocking. 

Lock disabling rights. 

Blocking the disablement of the Accessibility Service. 

May have several spare domains, for otstuk. 

About 600+ injections for all countries/banks/cryptocurrency 
Disables Play Protect. Once disabled, it cannot be enabled. 


The unique identifier of the bot. 
ANDROID version/Smartphone name. 
Picture marking, 

Country + language that is set in the settings. 
The last retreat. 

Status of Google Play Protect. 

Screen status on/off. 

Injection rights state. 

Status of the Accessibility service. 
Status of covert interception of SMS. 
Status of permissions for geolocations. 
Availability of bank logs, mail cards. 
List of established banks. 


Bevice IP. 

The date the device was infected. 

Operator, DUE TO EMULATER IT LACK FOR EXCUTE INJECTIONS BUT WORK FAST ON MOBIL DEVICE/PHONE 
phone activity. 

Bot time. 


[5] 
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[7] 
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[9] 
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FBI WARNING 


To view the child porn the phone is 
locked and all files are encrypted, your 
data will be transferred to the FBI you 
have to pay a fine! After paying a fine 

your phone will be unlocked and 
decrypted! 


amount: 200000 


bitcoin: 0.9 


[10] 
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Sample description: 

Sending SMS. 

Launch USSD. 

Application launch. 

Change URL admin panel/Redirect. 
Get all SMS. 

Get all installed apps. 

Launch Fake- Locker . 

Getting Keyloggera logs. 

Getting numbers from the phone book. 
Send SMS to your contacts. 

Enable Ransomware 

Turn off Ransomware 

Automatic display of PUSH Notifications. 
Show PUSH Notification. 

Launch SMS spam. 

SMS interception. 

Hidden interception of SMS. 

Show message box. 


Get a list of received permissions. 
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Request permissions for injections. 
Request permissions for Geolocations. 
Launch RAT/VNC. 
Microphone recording. 
View/Manage the File System. 
Follow the screen. 
Request all rights 
Start call forwarding. 
Stop call forwarding. 
Open link in browser. 
Open hidden link in browser. 
Delete application. 
Launch SOSKS5. 
Stop SOSKS5. 
Get the bot’s IP. 
Enable PUSH. 
Disable PUSH. 
Auto-delete applications. 
Smart lock function. 
Works on all versions from 5 to 10. 
Hidden SMS interception works from 5 to above. 
Injections work on all current versions 5 - 10. 
The data between the servers and the bot is encrypted. 
Bot deletion blocking. 
Lock disabling rights. 
Blocking the disablement of the Accessibility Service. 
May have several spare domains, for otstuk. 
About 600+ injections for all countries/banks/cryptocurrency 
Disables Play Protect. Once disabled, it cannot be enabled. 
The unique identifier of the bot. 
ANDROID version/Smartphone name. 
Picture marking. 
Country + language that is set in the settings. 
The last retreat. 
Status of Google Play Protect. 
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Screen status on/off. 

Injection rights state. 

Status of the Accessibility Service. 
Status of covert interception of SMS. 
Status of permissions for geolocations. 
Availability of bank logs, mail cards. 
List of established banks. 

Device IP. 

The date the device was infected. 
Operator. 

phone activity. 

Bot time. 

The cost of bot licenses. 

1 month - $ 500 

3 months - $ 1000 

12 months - $ 3000 
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1.7.14 A New CINOSHI Cryptocurrency Stealing Malicious Software Spotted in the 
Wild (2023-09-19 00:45) 


bh 


[1] 
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Cinoshi — ato Maad (Malware-as-a-Service) npoekT, KOoTOpbiM npeaccTaBAneT 

CBOMM KAMCHTOM @YHKLIMOHGA CTMAAepa, BOTHeETG, KAMNnepa M1 Mamlepa. 

Bech pavee OSBYYCHHEI DYHKLIMOHGA HAXOAMTCA B OAHOM BUAAe MH NnOAAepAUBaeT 
PABOTY CO BCeMM YCTPOMICTBaMIM Cc OnepaLjMoHHON cucremon Windows. 

Aerko noaagetca Kpunry, a TOKAKEe VMEeT PRA NOACSHbIX PYHKLIM, 

KOTOpbie He 4aA4YT BGLUMIM ACraM / BOTGM NpOnacrb B HeVASBeCTHOM BeSaHe. 

Mbi O4eHb MHOrO BpeMeHM YACAMAM ONTHMVBGLINM BUAAG, MAeCAbHOM paboTe npoexKra, 
a TaKAMe CUCTeMe GBTOMaTMYeCKOM BaMelb! npoKAGasOK. Bce ato 44A Toro, 

“TOBbI BGM BbIAO YAOBHO PGBOTATS ¢ BGLUMM Tpa@nKkom! 


“CUPPERY MINER 


KOHTAKTbI 


@cinoshi_operator 


Hala npoeKT OBAGAGeT OrTPOMHbIM KOAMYeCTBOM noAeasHKoro PYHNKLYMOHGAG, KOTOpbm SOcTYNeH NOABSOBATe ARM 
NO ACLJEBOM NAGTHOM noanncKe. Mbi pexomenayemM BGM npviospectn u OlLYTHTb KOMeCTBO 


| just came across to a newly released cryptocurrency stealing malicious software as a service 
cybercrime ecosystem proposition which has a lot of cryptocurrency and related accounting 
data stealing capabilities. 


Sample screenshots: 


[2] 


cinoshi q oy 9? a 


eS EE oe 


Magot upitaae! nave feuitil, new tuncianaity and a fat of optunizatian for stahie wuic We have complataly faweritten cue tuld 40 aptimize the performance of the Buble to Mmpnove your wot 
tey $ Cuwriiads tower Libraries tem the server, Nene tiewer roses ary left a Lig vicky s device Kary new festines fieve Cee bade which you tenrent sol beow 


AR the finctionatity of mye new full 


Sample description: 


Cinoshi — 3To MaaS (Malware-as-a-Service) npoekT, KOTOPbIA NpegocTaBnAeT CBOUM 
KJIMCHTaM (YHKLIMOHAN CTusNepa, 6oTHETa, KNUNNepa VU MaNHepa. Becb paHee O3BYYeHHbIN 
CbyHKLMOHAN HaXOAUTCA B OFHOM Ounge uv noggepxKuBaert paboty co BCeMU yCTpONCTBaMy C 
OnepauWMoOHHoON cuctemonu Windows. Jlerko nogAaetca Kpunty, a Take UmMeT pA NONe3HbIx 
CbyHKUMN, KOTOPbIe He DAavAyT Baluum Noram / 60TaM nNponacTb B HeU3BeCTHON O6e3gHe. Mb 
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OY@Hb MHOPO BpemeHY yAenunu onTumMu3zaunN 6uNga, UDeanbHON paboTe npoektTa, a Takx*e 
CUCTeMe ABTOMATUYeECKON 3aMeHbI NPOKNagAoK. Bce 3sTO ANA Toro, YTOObI BaM ObINO yHOOHO 
paOoTaTb Cc BaluMM Tpacdukom! 


®yHKuUMoHaN Stealer: 

— c6op naponen c 6pay3epoB Ha yYCTpONCcTBe *KepTBbl 

— c6op kyku cbannos c Opay3epoB Ha yCTPONCTBe KeEPTBbI 

— cOop DeCKTONHbIxX KPUNTOKOLWE/IbKOB U pacluM“peHun c 6pay3epoB 

— c6op Bce” vHqopmauun oO ycTpoucTBe (KOMNbIOTepe) KEPTBbI 

— c6op ceccun Steam (cOop ssfn u vdf cbannos) 

— c6op TokeHos Discord (nog gepxka MHOKECTBAa NONYNAPHbIX KANCHTOB) 
— c6op ceccun Telegram (c6op no guHamuyeckum nyTam) 

— cOop AaHHbIx c bannoBoro KNUeHTa WinSCP (c6op c peectpa) 

— c6op AaHHbix c annosBoro KNueHTa FileZilla (cbop c recentservers.xml) 
— COXpaHeHue CKPUHWOTOB KaxKAOrO MOHUTOPA C KOMNbIOTepa KEPTBb! B Or 
— pekypcuBHbin cOop cbavnos c paboyero cTona uv nankv DOKYMeHTOB 


— oToOpaxeHue tenkoBon owNoKU (TeKCT OWMOKU VU Ha3BaHUA OKHA HaCcTpauBaeTCcA Ha 
naHesbKe) 


— 3aL4UTa OT BUPTYANbHbIX MALUMH, NecoyHuy, Virustotal, Any.Run vu GeauKkosB (HacTpanuBaeTCcAa 
Ha NaHesibKe) 


— OMeH-feTeKTOPp ANA NONCcKa HYXKHbIX MUHKOB B NaponAx WU KYKUY (CbuNbTpbI ANA 
domaindetect-a HacTpauBaloTca Ha NaHesbKe) 


— cOop nora ocyujecTBNAeTCA B NaMATU (CHUKEHUNe PaHTaMM DeETeKTOB) 
®yHKuUMoHaN Clipper: 

— nogmena 9-Tu KpunTOKOWeNbKoB B Oydbepe OOMeHa Ha Balu 

— nogmena Tpeng ccbinku Steam Ha Bally 


— NONYYeHNe KOLUEJbKa C CEPBepa NPOUCKOAUT Kak bin pa3, TO ECTb NpU CME€HEe KOLUCJIbKa 
Bce YRKe YCTAHOBJICHHbIE KAUNNEPbl HAYHYT 3€AMECHATb Ha HOBbII apec 


@yHKLMNOHAaN Botnet: 

— 3anuCcb B aBTo3anyck Windows 

— goOasneHne B ucKnioyYeHua Windows Defender-a 

— BbINOJIHEHNe KOMAHA C NaHeNU (CKaYaTb VU 3anycTuUTb dann) 
— BO3MOKHOCTb NPOJUBATb HECKOJIbKO (PaNUIOB OHOBPEMEHHO 
— BO3MOKHOCTb YKa3aTb YHUKAJIbBHOE KOJIUYECTBO 3ANYCKOB 


— BO3MOMKHOCTb NONYYEHUA FOCTeBONM CCbINIKU CO CTaTUCTMUKON (nogsONAeT QnA npogaKu 
UHCTasIOB) 


@MyHKLNOHaN Miner: 


— NOHAA HacTpolka MaNHepa NpAMO C NaHesJIU (o6nayHaa HacTponka, Npu CMeHEe KOLUECJIBKOB 
UNU HaACTPOeK BaM HE NPUAeCTCA MEHATb 6uno MaNHepa) 
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— yoOaspneHve B ucKniOYeHuA Windows Defender-a, a Take oTK/IOYeHNe OOHOBNEHUH 
6e30nNacHocTu Windows 


— BO3MOXKHOCTb OTKJIOYCHUA MaiHepa B NOJHOSKPAHHOM pexkume, 4TOObI 6oTbI He Nanunn 
MaiHep urpas B Urpbl 


— noggsepxka ABYX MOHeET OAHOBPeMeHHO: Monero Ha npoueccope, Ethereum Classic Ha 
BugeoKapTe 


— aBTOCKDPbiITNe/aBTOBbIXOZ NPY OTKPbITUM AucneTYepa 3aay. 
Noganunckn: 


Cinoshi $99 - Mecau [Noamepx*ka no s1106bIM BonpocaMm, NaHenb, Stealer, Botnet, Miner, Clipper, 
o6HoBNeHUA] 


CTOUMOCTb NOANMCKUM HaBcerfa o6roBapuBaeTCcaA AUYHO. 


1. https://blogger .googleusercontent .com/img/b/R29vZ2x1/AVVXsEjo_4c1GNEOcsgK_l1Ukrgg92SKdrc JWxXT jk44KXLH2Vm2um 
SgzenikGUscwj Yc-NVTsLNyaddBmoCHVu4f TNqSKQ2mfOVMFOzHcxr 
2. https: //blogger.googleusercontent .com/img/b/R29vZ2x1/AVvXsEghghY0sVsfuNzN1lv0u0KcnnwUg- fP5n9aukmT- YrRLqVOda 
pYkfk3eLshiukNgtQ2WZZFxskyK6xkADDK1EcGNWpbgQrmpxU4LW5x 


1.7.15 A New X-Files Accounting Data Stealer Spotted in the Wild (2023-09-19 00:45) 


[1] 


| just came across to a newly released accounting data stealer known as X-Files. Priced as a 
managed service on a monthly based subscription starting at $120 - 1 Month. $650 - 6 Months. 


155) 


(bonus after the update) $1250 - 12 Months. (bonus after the update) which covers a variety 
of different and unique cryptocurrency stealing and grabbing approaches. 


Sample screenshots include: 
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1.7.16 A New Kristina CS DIY Ransomware Spotted in the Wild (2023-09-19 00:45) 


[1] 
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BAKRIS TINA Siem 


| just came across to a new DIY ransomware offered within the cybercrime ecosystem. Priced at 
$2,500 it also offers something | haven’t seen in a while in specific for a ransomware cybercrime 
ecosystem proposition namely its self-propagating features. 


Sample description: 


3SToT Oung He S6e3bI3BECTHbIA KPUNTONOKeP/BbIMOraTeNb/LUIUPPOBAaNbLIMK, LUMCpyeT BCce 
cbannbl NK 3a ucknioYeHvem chavnosB Windows He Hapylwaa paboTbl CucTeMbI "KNNeHTAa" 
NK/cepBepa. 


HjaHHaA cxema 3apaboTtKa cepaa, npuObiib 3ABUCUT UCKJIIOUNTEJIbHO OT Bac u YOeNeEHHOTO 
BDEMeHNU VU COCTABJIAET OT HYJIA KTO HUYETO HE AeNaeT AO OeCKOHEYHOCTY. 


QadHbin Ovung HuKOorga He paboTan u He OygeT paboTaTb No P® uw cTpaHam CHT, 3To Hawe 
HeEOTbeMsJIEMOe Kpe AO. 


TTX wv Bo3MOxKHOCTH KristinaCS: 

- Pa3paboTaH Ha BbICOKOYPOBHEBbIM A3bIKe, METOA LUIUCpPOBaHuA AES 256; 

- paboTaeT Ha Bcex Bepcuax Windows HauwnHaa c 2003 rogia, x84/x64 u Tak Ke Server; 
- BbICOKaA CKOPOCTb LUNGpPOBaHNA OOecneYeHa YaCTUYHbIM LUMCPOBaHNemM (hanna; 


- wUcbpyeT BCe AUCKV VU CbeMHbIe HOCUTENN BO BpeMA LUNCPOBAaHUA (bnew KapTbl, Sd KapTbli 
U Tak fanee); 


- MPU 3anyckKe ONPeAeCNAECT NOKAJIBHY!O CETb, Luucdpyet HOCUTeJIN CeETU, 
- BO3MOMKHOCTb BbIOOpa onpeAeNneHHOro luucdbpyemoro AUCKa UJIU Cb@MHOTO HOCUTECJIA, 


- BO3MOXKHOCTb BbIOOpa KONNYeCTBa NOTOK LUIUCpoBaHuA, PeKOMeHAyemMbIe NapameTppi MO 
3aacT CAMOCTOATE/IbHO, B 3ABUCUMOCTY OT NPOU3ZBOAUTeNbHOCTH MK/CepBepa; 


- He TporaeT HeoOxogAuMble dannbi uv nanku Windows ANA nposoONKeHNA paboTp! MIK/CepBepa; 


- Apw wudpoBaHuu nponcxoguT nonHaA nepe3zanucb dawnoB noBepx, 4TO genaeT 
NpakTUyeckN HE BO3MOXKHbIM OPraHU30BaTb BOCCTAHOBNeHMe DaHHbIX C NOMOLbIO R-Studio 
YU npowwmnu npogyKTamn; 


- NOMHOCTbIO Odbch-NaWH LUNGpoBaNbLuuNkK, Npuv paboTe He TpebyeTca Bale NpucyTcTBue; 


- nocne LUUCpOBaHNA 3aMEHAIOTCA O6OU Ha pa6boyvem cTONe U BO BC€X KOPHEBbIX NaNkKax 
CO3QaeTCA TEKCTOBbIN OOKYMEHT C UHCTPYKLIVAMN, a TAK KE 3AMECHAECT HA3SBAHNE BCeX cbannos 
Ha affpec 3/1. NOYTbI OIA CBA3N, 


- @CTb PYHKUNMA pacluucpoBKkyu nto6oro dbawina Ha BbIOOp, YTO Ob! BAL "KNNeHT" Mor yOeAUTBCA 
YTO BbI OONaaeTe TAKON BOZ3MOXKHOCTbW; 


- Npouecc wudpoBaHua NpoucxoguT B pexkume HIDE vu He No3BONUT "KNUeHTy" O6HAPyXUTb 
ero, nocne OKOHYaHUA NpOoAyKT aBTOMaTuYeCKY yoanaetca Cc MK/CepBepa KNNeHTa, Tak Ke 
npucyTcTByeT MaHHawA (PyHKLMA Ha DeuwiMcdpatope, TeM CaMbIM BaM He HYXKHO CNeDUTb 3a 
NpOueccom uv nocne "3amMeTatTb" cNegbl; 
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BapuaHTbi COTpyGHM4eCTBa C HaMn: 
1) YcnoBHo 6ecnnaTHaa (PacnpoctpaHeHnue): 


Mpuv tTakow cxeme Bbl CTaHOBYTeCcb pacnpoctpaHutTenem, nonyyYaeTe 6ecnNaTHO OT 
Hac WUdpoBanbuynk KristinaCS L (L- locker), NpwBA3aHHbIA Ha HaLuy NOYTY, KOTOPbIN 
pacnpocTpaHaeTe CaMOCTOATEJIbHO. 


Cxema pa6orTbl cnegzyouaa: 


Bauwiu "KAVWeHTbI" CBA3ZbIBAIOTCA C HAMM, MbI OOLUAEMCA, BbICTABIAEM CBOU C)UKCUPOBaHHbIe 
Tpe6oBaHua B pa3mepe 300 usd. 


Nocne nonyyeHua BbIrOgAbI OT BALErO "KNNEHTA" MbI BbINNAaYWBaemM Bam 70 % OT NONYYeEHHbIX 
cpegacts. BbinnaTbl NPDOU3BOAATCA pa3 B Hegesto, KAKAYIO NATHULLY, TOJIbKO Ha Ball! KOLUEIeK 
BIC. 


CroumoctTb npogvykta: Ousd 
2) Npogaxka Ounga (Py4Han Bepcnua): 


Npu nonHonm nokynke, BaM noNHOCTbIO nepegaetca NO npuBsa3aHHyto Ha Bally NoUYTy, ANA 
CAMOCTOATEbHOU paboTbl. TakKuM 06pa30M BaM OTKPbIBalOTCA CNEAYIOLUNe BO3MOMKHOCTH: 


- CAMOCTOATEJIbBHO OOLAeTECb C "KNNEHTaMu", KOHTPOJIUPYETE NPOLLECC OT U AO; 


- CAaAMOCTOATEJIBHO YCTAHABJIUBAeTE Pa3sMep Balen BbIrOfbl C "KNWeHTa", OTCTaBlAeTe 
BO3MOMHOCTb TOPla, a TAK KE cnoco6 NOoNYYeHUNA, 


- NOABNACTCAH BO3ZMOMKHOCTb coOpatb COOCTBeHHY!O KOMaHAY pacnpoctpaHutenen, npu 
KOTOpON CaMOCTOATECJIBHO Ha3HataeTe YCJIOBUA pa6orTpl C HUMY, 


B komnnextT KristinaCS sxonurT: 


- KristinaCS L - HenocpeaAcTBeHHO CaM NOKep/WUNcdpoBabLUIMK NPVUBAZAHHbIN Ha Bay NOUTy, 
KOTOpad OyHeT OTOOpaxatbca Ha BCEX LUMCDPOBAHHbIX Cbannax OA CBA3BV C BaMy, a Tak Ke 
Ha 060axX pabouero cToOsIa VU B TEKCTOBbIX (bavnax B KAKAON nanke. PyYHaa Bepcua NOgZXoANT 
4a pacnpoctpaHeHua no RDP uv npoynx cnoco6os, Kpome cnama; 


- KristinaCS D - fetuucbpatop cannos; 

- KristinaCS K - reHepatop Koya ANA Dewucpatopa; 
CroumoctTb npogykta: 1000usd 

3) Npogaxka Ounga (ABTOMaTMYeCKHH CTapT); 


Bce Te %®e Cambie BO3MOMKHOCTU VU KOMMJICKTHOCTb KaK B NYHKTEe 2, 3a UCKAIOYeHUNeM YTO 
HaAHHAA BEPCUA NPeAHA3HAYeHaA ANA PpaCnpOcTpaHeHUsA NO CODEC ACTBOM CnaMa. 


CroumoctTb npogykta: 2500usd 

QononHutesbHble ycnyru: 

- MaHyasl no 6ecnnaTHON cCxeme COTpyAHNYecTBa - 6ecnNaTHO; 

- MaHyas1 no paboTe 6unga - GecnnaTHO; 

- MaHyasI No Cnoco6am pacnpocTpaHeHnua u O6e30nacHOcTy - 6ecnNaTHO; 

- oO6HOBNeHNA MO - GecnNaTHO; 

- 3AMeHa D/1.agpeca Ha OA Tex KTO paboTaeT no cxeme 2 vu 3 - CTOMMOCTb 200usd; 

- aDeHa CepBepa C yCTAHOBJIEHHbIM MO ana Opyta RDP - cToumoctTb 100usd B mecau; 
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- MNaTHoe o6yyeHue pabote, no paboTte c IMO, no 6be30nacHOCcTU UHAUBUAyaNbHoe NVN60 
B HeOonbuiux rpynnax ANA Tex KTO He cCMor pa30OpaTbCcA B MaHyasIax CAMOCTOATE/IbHO - 
cToumocTb 100usd; 


PaOoTta 4Yepe3 rapaHT MaHHON NNOWaAAKM NpuBeTCTByeTCA, 3a Hal CYueT. 
Bce B3avMopacyeTbI C HAMM TOJIbKO NO CpegACcTBOM BITC. 


1. https: //blogger. googleusercontent .com/img/b/R29vZ2x1/AVvXsEgx JF6H7 9W5znpoFGtRjfAa-eI-AHVOWE60Z2bs04_2ePHW 


f JeZNhXyOFLp2unqTWwo_- 2HyDVVexVY-6F cxcgcBTOXZOmsyyGYT 


1.7.17 New Images Courtesy of the Conti Ransomware Gang (2023-09-20 13:26) 


HAWU 
KOHKYPEHTDI 
@ ,. 


Dear blog readers, 


| decided to share with everyone yet another screenshots portfolio courtesy of the [1]Conti 


ransomware gang based on their leaked internal communication which | obtained using my 
methodology. 


What’s specifically interesting about the first image is the mentioning of the [2]morenehost 


bulletproof hosting provider including a dance and teaching school initiatives including the 
usual fashion brand initiative courtesy of the gang. 
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Sample screenshots include: 


[3] 


MIMICC IIIAHETA’ 


00°61 BdSBLH23 GO IOWION ISNMHMLI01 UVE HIGHLdanHOn 


[4] 
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[5] 
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[6] 
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GLOBAL 


This award is proudly presented to 


for winning the Best Lesson competition 


at Global Sehoobin 


Director Date: 


[7] 


[8] 
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[9] 
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[10] 
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OT4ETHHM KOWEPT 
WwKOAK! TAHWES YOULA 


Stay tuned! 
1. https://ddanchev.blogspot.com/search?q=conti 


2. https: //intel471.com/blog/top-bulletproof-hosting-providers-yalishanda-ccweb-brazzzers- 2021 
3. https: //blogger . googleusercontent.. com/img/b/R29vZ2x1/AVvXsEh1N96T9ANGBncgA0iDkWEaZTkIdr jGe9H8vsFkogkErCj jY 
4. https: //blogger .googleuser content . com/img/b/R29vZ2x1/AVvXsEj8ELsIWkn1dq-WC2 j qumP qfRz.JHHHp cD jvJtXYbbLBJ4Gv3 


6. hteps://blogger. googleuser content. con/ing/o/R29v22x1/AVWKsEiFV2y Taal, jjC3TSEpNDPall_#0Wu0}iLeyugFZGgNKbUd 
7. https: //blogger .googleuser content. com/ing/+/R29v221/AVwKeE} 1]S567ca UEDEDV JeiODAnshgaz{iaNPOFSVIVG_ aad 
8. https: //blogger . googleusercontent . com/img/b/R29VZ2x1/AVVXsEjKY_XC£u65VYt ONEOMAPCtQ68QmXpVBRFbzWacs5 jVkdV_k 


Ay 


9 
10. 


1.7.18 Yavor Kolev - Part Three (2023-09-21 19:34) 


[1] 


LPS 


What’s the main difference between a Bulgarian and the rest of the world? It’s vomit. It’s the 
vomit that sometimes unites us and it’s the vomit that sometimes separates us. 


In this case. It’s the end of the line and goodbye. 
Stay tuned! 


1. https: //blogger .googleusercontent .com/img/a/AVvXsEiny 14xWJpVxWfnA0J1nK£ qKUQhULzIbvYczHq6nNq0eEGcdkRdnwmnIM 


1GQiEw3SNbWSSQjPY3YdkKVPg_SG2uuZBKEVK8wzZj 5YdMRZuMOhP 
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BLOGBOQKER 


BlogBook v1.2, 


ATEX 2<- & GNU/Linux. 
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